We have detected a lot of Failure Audit errors (MSSQLSERVER) on our Web Server for.

Something like Login failed for user 'sa'. [CLIENT:]

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

IPs are unknown, and we would like to know is this a potential security issue or what can cause this.


I adjusted Windows Firewall to prevent access to MSSQL outside server IP, but that did not work.

Here is what I did Firewall > Programs and Service > cheched MSSQL Firewall > Edit > Name:MSSQL, PortNumber 1433, TCP, scope: serverIP/

  • Are the web and database server hosted on the same machine? What full version of sql server is running? – Cougar9000 May 29 '13 at 19:37

It appears that you have exposed your SQL Server to the internet, and now you are seeing brute-force attempts from the internet to log in with the well-known SQL account sa.

I don't know your business needs, but consider adjusting your firewall so that the only IP that is able to reach your database server is your web server, for instance.

Edit: If your web server and your database server are the same, the fact remains that you need to use a firewall, either software or hardware, to block incoming connections to port 1433 from the internet.

| improve this answer | |
  • 1
    It would also be wise to either disable or rename the SA account in SQL Server. – Cougar9000 May 28 '13 at 14:38
  • @Cougar9000 good alternative, but it would also open sql for outside connections – John May 28 '13 at 18:49
  • @Ryan Ries is there an option on SQL to close port 1433, or it can only be blocked on firewall? – John May 28 '13 at 18:50
  • @John This needs to be done via firewall. A hardware firewall is preferred, but in the meantime you could at least use the software firewall that comes with Server 2003... it sucks, but it's better than nothing. – Ryan Ries May 28 '13 at 18:55
  • @RyanRies I have changed the firewall setting, and will monitor Event log. – John May 28 '13 at 19:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.