MOSS event ID 3351 Login failed for user 'NT AUTHORITY\ANONYMOUS LOGON'

Wed, 11 Feb 2009 07:07:58 Z

Hi,

I've got a lot of 3351 events in my event viewer, every day at the same hour (23:00PM, 2:00AM, 16:30PM). I've tried to restart services and web aplication, but it doesn't help.

SQL database login failed. Additional error information from SQL Server is included below.

Please help

My log file:

02/11/2009 02:00:04.87 SPWRITER.EXE (0x08F4)                   0x0720 Windows SharePoint Services   Database                      880i High    System.Data.SqlClient.SqlException: Login failed for user 'NT AUTHORITY\ANONYMOUS LOGON'.     at System.Data.SqlClient.SqlInternalConnection.OnError(SqlException exception, Boolean breakConnection)     at System.Data.SqlClient.TdsParser.ThrowExceptionAndWarning(TdsParserStateObject stateObj)     at System.Data.SqlClient.TdsParser.Run(RunBehavior runBehavior, SqlCommand cmdHandler, SqlDataReader dataStream, BulkCopySimpleResultSet bulkCopyHandler, TdsParserStateObject stateObj)     at System.Data.SqlClient.SqlInternalConnectionTds.CompleteLogin(Boolean enlistOK)     at System.Data.SqlClient.SqlInternalConnectionTds.LoginNoFailover(String host, String newPassword, Boolean redirectedUserInstance, SqlConnection owningObject, SqlConnectionString connectionOptions, Int64 timerStart)     at Syste...
02/11/2009 02:00:04.87* SPWRITER.EXE (0x08F4)                   0x0720 Windows SharePoint Services   Database                      880i High    ...m.Data.SqlClient.SqlInternalConnectionTds.OpenLoginEnlist(SqlConnection owningObject, SqlConnectionString connectionOptions, String newPassword, Boolean redirectedUserInstance)     at System.Data.SqlClient.SqlInternalConnectionTds..ctor(DbConnectionPoolIdentity identity, SqlConnectionString connectionOptions, Object providerInfo, String newPassword, SqlConnection owningObject, Boolean redirectedUserInstance)     at System.Data.SqlClient.SqlConnectionFactory.CreateConnection(DbConnectionOptions options, Object poolGroupProviderInfo, DbConnectionPool pool, DbConnection owningConnection)     at System.Data.ProviderBase.DbConnectionFactory.CreatePooledConnection(DbConnection owningConnection, DbConnectionPool pool, DbConnectionOptions options)     at System.Data.ProviderBase.DbConnectionPool.C...
02/11/2009 02:00:04.87* SPWRITER.EXE (0x08F4)                   0x0720 Windows SharePoint Services   Database                      880i High    ...reateObject(DbConnection owningObject)     at System.Data.ProviderBase.DbConnectionPool.UserCreateRequest(DbConnection owningObject)     at System.Data.ProviderBase.DbConnectionPool.GetConnection(DbConnection owningObject)     at System.Data.ProviderBase.DbConnectionFactory.GetConnection(DbConnection owningConnection)     at System.Data.ProviderBase.DbConnectionClosed.OpenConnection(DbConnection outerConnection, DbConnectionFactory connectionFactory)     at System.Data.SqlClient.SqlConnection.Open()     at Microsoft.SharePoint.Utilities.SqlSession.OpenConnection()
02/11/2009 02:00:04.87 SPWRITER.EXE (0x08F4)                   0x0720 Windows SharePoint Services   Database                      880j High    SqlError: 'Login failed for user 'NT AUTHORITY\ANONYMOUS LOGON'.'    Source: '.Net SqlClient Data Provider' Number: 18456 State: 1 Class: 14 Procedure: '' LineNumber: 65536 Server: 'nero\moss'
02/11/2009 02:00:04.87 SPWRITER.EXE (0x08F4)                   0x0720 Windows SharePoint Services   Database                      6y64 Critical SQL database login failed. Additional error information from SQL Server is included below. Login failed for user 'NT AUTHORITY\ANONYMOUS LOGON'.
02/11/2009 02:00:04.89 SPWRITER.EXE (0x08F4)                   0x0720 Windows SharePoint Services   Database                      880k High        at Microsoft.SharePoint.Utilities.SqlSession.ExecuteReader(SqlCommand command, CommandBehavior behavior)     at Microsoft.SharePoint.Administration.SPConfigurationDatabase.FetchId(QualifiedObjectName qName)     at Microsoft.SharePoint.Administration.SPConfigurationDatabase.GetObject(String name, Guid parentId, Type type)     at Microsoft.SharePoint.Administration.SPConfigurationDatabase.get_Farm()     at Microsoft.SharePoint.Administration.SPConfigurationDatabase.SPFileSystemCacheWatcher.OnChanged(Object source, FileSystemEventArgs e)     at System.IO.FileSystemWatcher.CompletionStatusChanged(UInt32 errorCode, UInt32 numBytes, NativeOverlapped* overlappedPointer)     at System.Threading._IOCompletionCallback.PerformIOCompletionCallback(UInt32 errorCode, UInt32 numBytes, NativeOverlapped...
02/11/2009 02:00:04.89 SPWRITER.EXE (0x08F4)                   0x0720 Windows SharePoint Services   Database                      880k High        at Microsoft.SharePoint.Utilities.SqlSession.ExecuteReader(SqlCommand command, CommandBehavior behavior)     at Microsoft.SharePoint.Administration.SPConfigurationDatabase.FetchId(QualifiedObjectName qName)     at Microsoft.SharePoint.Administration.SPConfigurationDatabase.GetObject(String name, Guid parentId, Type type)     at Microsoft.SharePoint.Administration.SPConfigurationDatabase.get_Farm()     at Microsoft.SharePoint.Administration.SPConfigurationDatabase.SPFileSystemCacheWatcher.OnChanged(Object source, FileSystemEventArgs e)     at System.IO.FileSystemWatcher.CompletionStatusChanged(UInt32 errorCode, UInt32 numBytes, NativeOverlapped* overlappedPointer)     at System.Threading._IOCompletionCallback.PerformIOCompletionCallback(UInt32 errorCode, UInt32 numBytes, NativeOverlapped...
02/11/2009 02:00:04.89* SPWRITER.EXE (0x08F4)                   0x0720 Windows SharePoint Services   Database                      880k High    ...* pOVERLAP)
02/11/2009 02:00:04.89* SPWRITER.EXE (0x08F4)                   0x0720 Windows SharePoint Services   Database                      880k High    ...* pOVERLAP)
02/11/2009 02:00:04.89 SPWRITER.EXE (0x08F4)                   0x0720 Windows SharePoint Services   Database                      880l High    ConnectionString: 'Data Source=nero\moss;Initial Catalog=SharePoint_Config;Integrated Security=True;Enlist=False'    ConnectionState: Closed ConnectionTimeout: 15
02/11/2009 02:00:04.89 SPWRITER.EXE (0x08F4)                   0x0720 Windows SharePoint Services   Database                      880l High    ConnectionString: 'Data Source=nero\moss;Initial Catalog=SharePoint_Config;Integrated Security=True;Enlist=False'    ConnectionState: Closed ConnectionTimeout: 15
02/11/2009 02:00:04.89 SPWRITER.EXE (0x08F4)                   0x0720 Windows SharePoint Services   Topology                      888j Medium System.Data.SqlClient.SqlException: Login failed for user 'NT AUTHORITY\ANONYMOUS LOGON'.     at System.Data.SqlClient.SqlInternalConnection.OnError(SqlException exception, Boolean breakConnection)     at System.Data.SqlClient.TdsParser.ThrowExceptionAndWarning(TdsParserStateObject stateObj)     at System.Data.SqlClient.TdsParser.Run(RunBehavior runBehavior, SqlCommand cmdHandler, SqlDataReader dataStream, BulkCopySimpleResultSet bulkCopyHandler, TdsParserStateObject stateObj)     at System.Data.SqlClient.SqlInternalConnectionTds.CompleteLogin(Boolean enlistOK)     at System.Data.SqlClient.SqlInternalConnectionTds.LoginNoFailover(String host, String newPassword, Boolean redirectedUserInstance, SqlConnection owningObject, SqlConnectionString connectionOptions, Int64 timerStart)     at Syste...
02/11/2009 02:00:04.89 SPWRITER.EXE (0x08F4)                   0x0720 Windows SharePoint Services   Topology                      888j Medium System.Data.SqlClient.SqlException: Login failed for user 'NT AUTHORITY\ANONYMOUS LOGON'.     at System.Data.ProviderBase.DbConnectionPool.GetConnection(DbConnection owningObject)     at System.Data.ProviderBase.DbConnectionFactory.GetConnection(DbConnection owningConnection)     at System.Data.ProviderBase.DbConnectionClosed.OpenConnection(DbConnection outerConnection, DbConnectionFactory connectionFactory)     at System.Data.SqlClient.SqlConnection.Open()     at Microsoft.SharePoint.Utilities.SqlSession.OpenConnection()     at Microsoft.SharePoint.Utilities.SqlSession.ExecuteReader(SqlCommand command, CommandBehavior behavior)     at Microsoft.SharePoint.Administration.SPConfigurationDatabase.FetchId(QualifiedObjectName qName)     at Microsoft.SharePoint.Administration.SPConfigurationDat...
02/11/2009 02:00:04.89* SPWRITER.EXE (0x08F4)                   0x0720 Windows SharePoint Services   Topology                      888j Medium ...m.Data.SqlClient.SqlInternalConnectionTds.OpenLoginEnlist(SqlConnection owningObject, SqlConnectionString connectionOptions, String newPassword, Boolean redirectedUserInstance)     at System.Data.SqlClient.SqlInternalConnectionTds..ctor(DbConnectionPoolIdentity identity, SqlConnectionString connectionOptions, Object providerInfo, String newPassword, SqlConnection owningObject, Boolean redirectedUserInstance)     at System.Data.SqlClient.SqlConnectionFactory.CreateConnection(DbConnectionOptions options, Object poolGroupProviderInfo, DbConnectionPool pool, DbConnection owningConnection)     at System.Data.ProviderBase.DbConnectionFactory.CreatePooledConnection(DbConnection owningConnection, DbConnectionPool pool, DbConnectionOptions options)     at System.Data.ProviderBase.DbConnectionPool.C...
02/11/2009 02:00:04.89* SPWRITER.EXE (0x08F4)                   0x0720 Windows SharePoint Services   Topology                      888j Medium ...abase.GetObject(String name, Guid parentId, Type type)     at Microsoft.SharePoint.Administration.SPConfigurationDatabase.get_Farm()     at Microsoft.SharePoint.Administration.SPConfigurationDatabase.SPFileSystemCacheWatcher.OnChanged(Object source, FileSystemEventArgs e)
02/11/2009 02:00:04.89* SPWRITER.EXE (0x08F4)                   0x0720 Windows SharePoint Services   Topology                      888j Medium ...reateObject(DbConnection owningObject)     at System.Data.ProviderBase.DbConnectionPool.UserCreateRequest(DbConnection owningObject)     at System.Data.ProviderBase.DbConnectionPool.GetConnection(DbConnection owningObject)     at System.Data.ProviderBase.DbConnectionFactory.GetConnection(DbConnection owningConnection)     at System.Data.ProviderBase.DbConnectionClosed.OpenConnection(DbConnection outerConnection, DbConnectionFactory connectionFactory)     at System.Data.SqlClient.SqlConnection.Open()     at Microsoft.SharePoint.Utilities.SqlSession.OpenConnection()     at Microsoft.SharePoint.Utilities.SqlSession.ExecuteReader(SqlCommand command, CommandBehavior behavior)     at Microsoft.SharePoint.Administration.SPConfigurationDatabase.FetchId(QualifiedObjectName qName)     at Microsoft.S...
02/11/2009 02:00:04.89 SPWRITER.EXE (0x08F4)                   0x0720 Windows SharePoint Services   Database                      880i High    System.Data.SqlClient.SqlException: Login failed for user 'NT AUTHORITY\ANONYMOUS LOGON'.     at System.Data.ProviderBase.DbConnectionPool.GetConnection(DbConnection owningObject)     at System.Data.ProviderBase.DbConnectionFactory.GetConnection(DbConnection owningConnection)     at System.Data.ProviderBase.DbConnectionClosed.OpenConnection(DbConnection outerConnection, DbConnectionFactory connectionFactory)     at System.Data.SqlClient.SqlConnection.Open()     at Microsoft.SharePoint.Utilities.SqlSession.OpenConnection()
02/11/2009 02:00:04.89* SPWRITER.EXE (0x08F4)                   0x0720 Windows SharePoint Services   Topology                      888j Medium ...harePoint.Administration.SPConfigurationDatabase.GetObject(String name, Guid parentId, Type type)     at Microsoft.SharePoint.Administration.SPConfigurationDatabase.get_Farm()     at Microsoft.SharePoint.Administration.SPConfigurationDatabase.SPFileSystemCacheWatcher.OnChanged(Object source, FileSystemEventArgs e)
02/11/2009 02:00:04.89 SPWRITER.EXE (0x08F4)                   0x0720 Windows SharePoint Services   Database                      880j High    SqlError: 'Login failed for user 'NT AUTHORITY\ANONYMOUS LOGON'.'    Source: '.Net SqlClient Data Provider' Number: 18456 State: 1 Class: 14 Procedure: '' LineNumber: 65536 Server: 'nero\moss'
02/11/2009 02:00:04.89 SPWRITER.EXE (0x08F4)                   0x0720 Windows SharePoint Services   Database                      880i High    System.Data.SqlClient.SqlException: Login failed for user 'NT AUTHORITY\ANONYMOUS LOGON'.     at System.Data.ProviderBase.DbConnectionPool.GetConnection(DbConnection owningObject)     at System.Data.ProviderBase.DbConnectionFactory.GetConnection(DbConnection owningConnection)     at System.Data.ProviderBase.DbConnectionClosed.OpenConnection(DbConnection outerConnection, DbConnectionFactory connectionFactory)     at System.Data.SqlClient.SqlConnection.Open()     at Microsoft.SharePoint.Utilities.SqlSession.OpenConnection()
02/11/2009 02:00:04.89 SPWRITER.EXE (0x08F4)                   0x0720 Windows SharePoint Services   Database                      6y64 Critical SQL database login failed. Additional error information from SQL Server is included below. Login failed for user 'NT AUTHORITY\ANONYMOUS LOGON'.
02/11/2009 02:00:04.89 SPWRITER.EXE (0x08F4)                   0x0720 Windows SharePoint Services   Database                      880j High    SqlError: 'Login failed for user 'NT AUTHORITY\ANONYMOUS LOGON'.'    Source: '.Net SqlClient Data Provider' Number: 18456 State: 1 Class: 14 Procedure: '' LineNumber: 65536 Server: 'nero\moss'

tnx

klemen

MOSS event ID 3351 Login failed for user 'NT AUTHORITY\ANONYMOUS LOGON'

Wed, 11 Feb 2009 08:46:42 Z

Check if this article from MSDN helps:
http://technet.microsoft.com/en-us/library/cc561068.aspx

--
Madhur

http://blogs.msdn.com/mahuja

MOSS event ID 3351 Login failed for user 'NT AUTHORITY\ANONYMOUS LOGON'

Wed, 11 Feb 2009 11:11:54 Z

Hi,

Service accounts and security rights on databases are OK, in fact everything is working fine, but I want to get rid of 3351 events.... it seems I've got hundreds of them in my event viewer...

tnx
klemen

MOSS event ID 3351 Login failed for user 'NT AUTHORITY\ANONYMOUS LOGON'

Wed, 11 Feb 2009 13:47:35 Z

Check this thread, exactly the same:
http://social.technet.microsoft.com/Forums/en-US/sharepointadmin/thread/af528a14-057c-464e-bfd9-4582121d16d0/

Regards
/Henrik

MOSS event ID 3351 Login failed for user 'NT AUTHORITY\ANONYMOUS LOGON'

Thu, 12 Feb 2009 07:29:10 Z

Hi,

Please check the account name of the application pool of the portal site to see if it is a domain account. If not, reset the application pool account to the domain account to see if it works.

Please let me know if there is any misunderstanding. Thanks!

Lu Zou

MOSS event ID 3351 Login failed for user 'NT AUTHORITY\ANONYMOUS LOGON'

Thu, 12 Feb 2009 08:21:35 Z

Hi,

I've noticed that event 3351 pops up even during backup (STSADM), but backup completed OK.

So, I followed the instructions in thread http://social.technet.microsoft.com/Forums/en-US/sharepointadmin/thread/af528a14-057c-464e-bfd9-4582121d16d0/
and run command line

psconfig.exe -cmd secureresources
Than I restarted my web front end server and run backup again for test. The event 3351 is not showing durig backup anymore!
It's posible that PSCONFIG is the solution... well I'll have to wait till tomorrow morning and check my event viewer.

tnx,

klemen

MOSS event ID 3351 Login failed for user 'NT AUTHORITY\ANONYMOUS LOGON'

Fri, 13 Feb 2009 09:12:23 Z

Unfortunately, this is not the solution, 3351 events are back (20:30PM, 1:30AM, 2:00AM)

tnx

klemen

MOSS event ID 3351 Login failed for user 'NT AUTHORITY\ANONYMOUS LOGON'

Tue, 17 Feb 2009 11:04:46 Z

Hi

Could you check the account name of the application pool of the portal site again and do the steps in the article below to see if this can work?

http://technet.microsoft.com/en-us/library/cc561068.aspx

Lu Zou

MOSS event ID 3351 Login failed for user 'NT AUTHORITY\ANONYMOUS LOGON'

Fri, 20 Feb 2009 11:47:28 Z

All web application accounts are OK. Event ID 3351 pops up at 20:30PM (backup with CA ARC Serve Sharepoint agent), at 1:20AM (backup with STSADM command) and 2:00AM (I can't figure it out what's going on at 2:00AM ?).
Both backups are done without any error.

tnx,
klemen

MOSS event ID 3351 Login failed for user 'NT AUTHORITY\ANONYMOUS LOGON'

Wed, 25 Feb 2009 08:50:09 Z

Hi,

Every time I run backup (from central administration or STSADM or CA ARCServe) event 3351 pops up on web front end server and event 18456 on SQL server. All backups are done without errors.
I've tried to update accounts http://support.microsoft.com/default.aspx/kb/934838 , but no luck.

Is there any solution?

tnx
klemen

MOSS event ID 3351 Login failed for user 'NT AUTHORITY\ANONYMOUS LOGON'

Mon, 02 Mar 2009 08:07:48 Z

Hi, Running Windows sharepoint services vss writer service under AD farm account (instead of Local system) is the solution of my issue! I'm so happy :) Tnx, Klemen