1

New MS SQL server 2019 installation on Windows Server 2019, failover cluster role enabled; fully patched Windows, SQL 2019 CU 11.

Nodes:
server1 - 10.10.10.1
server2 - 10.10.10.2

Instances:
sql1
sql2

The instances were initially installed: sql1 on server1, sql2 on server2, clustered install. sql1 and sql2 do failover smoothly, everything works as expected.

The problem is a seemingly harmful event on Windows Logs -> Application (Event ID 18456):

Login failed for user 'domain\server1$'. Reason: Could not find a login matching the name provided. [CLIENT: 10.10.10.1]

and

Login failed for user domain\server2$. Reason: Could not find a login matching the name provided. [CLIENT: 10.10.10.2]

The events are produced when sql1 is moved to server2 and sql2 is moved to server1. It seems that there is some kind of record on each instance with the server that was installed initially and is searching for it. No issues apart from the annoying message.

I've searched the Net a lot, tried the suggestions about disabling CEIP telemetry, disabled sql services one by one to locate the one producing the event (sql server produces it), added the NT AUTHORITY\NETWORK SERVICE to logins, sysadmin on both sql1 & sql2. No effect. Any ideas?


It seems that domain\server1$ is a service account - virtual account. In the initial sql instances installation some services where started by non-domain accounts (default suggestion). But now all services start using domain accounts, yet the event is still produced.

3
  • It seems that domain\server1$ is a service account. It's the computer account. In AD the computer account samAccountName is suffixed with $.
    – Greg Askew
    Nov 22, 2021 at 10:24
  • @GregAskew, it is, but I cannot locate any record of it, where it's used. I just get the event.
    – Krackout
    Nov 22, 2021 at 15:06
  • Nearly all Windows hosts use their AD machine account for authentication. May be a transient recoverable condition created by the failover.
    – Greg Askew
    Nov 22, 2021 at 16:26

0

You must log in to answer this question.