none
Event ID 18456 - Login Failed

    Question

  • Running MOSS 2007 Enterprise SP1 with SQL Server 2005 SP2 on Windows Server 2003 R2 Standard.
    ==============
    While working on another issue, I saw this error in my Application (Event) Log:

    Event Type:    Failure Audit
    Event Source:    MSSQL$WCTINTRANET
    Event Category:    (4)
    Event ID:    18456
    Date:        7/6/2009
    Time:        10:41:00 AM
    User:        WHOOPER\SQL2005
    Computer:    WCT-SHAREPOINT
    Description:
    Login failed for user 'WHOOPER\SQL2005'. [CLIENT: <local machine>]

    For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
    Data:
    0000: 18 48 00 00 0e 00 00 00   .H......
    0008: 1b 00 00 00 57 00 43 00   ....W.C.
    0010: 54 00 2d 00 53 00 48 00   T.-.S.H.
    0018: 41 00 52 00 45 00 50 00   A.R.E.P.
    0020: 4f 00 49 00 4e 00 54 00   O.I.N.T.
    0028: 5c 00 57 00 43 00 54 00   \.W.C.T.
    0030: 49 00 4e 00 54 00 52 00   I.N.T.R.
    0038: 41 00 4e 00 45 00 54 00   A.N.E.T.
    0040: 00 00 07 00 00 00 6d 00   ......m.
    0048: 61 00 73 00 74 00 65 00   a.s.t.e.
    0050: 72 00 00 00               r...   

    The instance is running in Windows Authentication mode.  The user cited is a local machine Admin, and has been granted Connect rights to the Master db, and was/is my SQL Server 2005 setup account and was used in MOSS 2007 setup as the designated db account.
    Took a look at some referenced KB's seen on eventid.net for the event id, but no luck.

    What am I missing?

    Mike Webb, IT Admin, Platte River Whooping Crane Maintenance Trust, Inc. (a 501(c)(3) conservation nonprofit org.)
    Monday, July 06, 2009 3:49 PM

Answers

  •  

    Hi Mike,

     

    Thanks for your cooperation.

     

    I noticed the error source came from the local machine.

     

    If the machine is dedicated database server and do not host SharePoint product, I suppose there were SQL Server agent job that was schedule to run every one minute and cause the error.

     

    Could you please check the SQL Server Agent > Jobs in the SQL Server Management Studio?

    In my local environment, there is a SSPDatabaseName_Job_DeleteExpiredSessions job and it was schedule to run every one minute.

     

    If the similar job existed in your environment, please check whether the database the job was configured exists or not.

    If the database was not existed, you could disable or delete the job to resolve the issue.

     

    Let me know the result if possible.

    -lambert


    Sincerely,
    Lambert Qin | Microsoft TechNet Managed Forum Support
    Posting is provided "AS IS" with no warranties, and confers no rights.
    Thursday, July 09, 2009 5:40 AM

All replies

  • Verify if this article could help.

    How to change service accounts and service account passwords in SharePoint Server 2007 and in Windows SharePoint Services 3.0

    André Lage Microsoft SharePoint and CRM Consultant
    Blog:http://aaclage.blogspot.com
    Codeplex:http://spupload.codeplex.com/http://simplecamlsearch.codeplex.com/
    Monday, July 06, 2009 9:14 PM
  • I'll check in the morning when I get to work. SO you think if I change it (in case I typed it wrong somewhere during setup) using this article that the change will "filter" down to SQL Server 2005 (where I think the problem lies)?

    Mike Webb, IT Admin, Platte River Whooping Crane Maintenance Trust, Inc. (a 501(c)(3) conservation nonprofit org.)
    Monday, July 06, 2009 10:44 PM
  • Hi Mike,

     

    Could you please clarify whether the issue was accompany with the restore issue in http://social.technet.microsoft.com/Forums/en-US/sharepointadmin/thread/707a6048-56a9-4dc7-9a75-26debe048bc8

     

    If so, I suppose the Failure Audit error was caused by the newly restored database.

    If the error occurred a few times when you performing the restore operation and never happened again, I think you could ignore the error.

     

    If not, please let me know more information for further research:

    1.    When was the first time logged in the Event Viewer?

    2.    The frequency of the error.

    3.    Was there any related symptom that could be observed?

     

    Let me know the result if possible.

    -lambert


    Sincerely,
    Lambert Qin | Microsoft TechNet Managed Forum Support
    Posting is provided "AS IS" with no warranties, and confers no rights.
    Tuesday, July 07, 2009 2:58 AM
  • I'll check the logs, but I think it's unrelated since the "fine print" of the error message said it's thet "master" db of the SQL Server Instance (in this case, WCTIntranet).
    Mike Webb, IT Admin, Platte River Whooping Crane Maintenance Trust, Inc. (a 501(c)(3) conservation nonprofit org.)
    Tuesday, July 07, 2009 1:36 PM
  • I don't know that it was caused by the issue in the other thread, but it's possible.  It started on 2 July - when I started to restore this db.
    It happens every minute.
    No other symptom I can find.

    What I've also done:
    (1) used the stsadm command to update the farm credentials for that account.
    (2) updated the password in every Service (Administration Tools > Services) that listed this account as the logon account.
    (3) reset the password on the DC.
    (4) rebooted the SharePoint Server so this account has to "login" for the password to take effect.

    However, I'm getting the exact same error in the Application (Event) log.
    Mike Webb, IT Admin, Platte River Whooping Crane Maintenance Trust, Inc. (a 501(c)(3) conservation nonprofit org.)
    Tuesday, July 07, 2009 3:18 PM
  • Hi Mike,

     

    I found a article Troubleshooting: Login Failed for User 'x' (http://msdn.microsoft.com/en-us/library/ms366351.aspx).

     

    As I don't know the completed error message, please compare State in the error message with the reference to know the cause of the error.

    If you could not find the State in the Application (Event) Log, please check the error log located at Program Files\Microsoft SQL Server\MSSQL.n\MSSQL\LOG\ERRORLOG and ERRORLOG.n files.

    You could View the SQL Server error log by using SQL Server Management Studio or any text editor.

     

    Additionally, please  try to change from Windows Authentication mode to SQL Server and Windows Authentication mode following How to: Change Server Authentication Mode and verify whether the issue is resolved.

     

    If the issue still persists, please let me know the Full 18456 error message in SQL Server error log files for further research.

     

    Let me know the result if possible.

    -lambert


    Sincerely,
    Lambert Qin | Microsoft TechNet Managed Forum Support
    Posting is provided "AS IS" with no warranties, and confers no rights.
    Wednesday, July 08, 2009 5:47 AM
  • The Severity for Error: 18456 is 14, State: 16.

    I changed from Windows Authentication Mode to SQL Server and Windows Authentication Mode , restarted the SQL Server, but the error persists in the Application log.
    Here are the full 18456 errors in the SQL Server error log files:
    ERRORLOG file
    2009-07-08 08:35:26.04 Server      Microsoft SQL Server 2005 - 9.00.4035.00 (Intel X86)
        Nov 24 2008 13:01:59
        Copyright (c) 1988-2005 Microsoft Corporation
        Standard Edition on Windows NT 5.2 (Build 3790: Service Pack 2)

    2009-07-08 08:35:26.04 Server      (c) 2005 Microsoft Corporation.
    2009-07-08 08:35:26.04 Server      All rights reserved.
    2009-07-08 08:35:26.04 Server      Server process ID is 6608.
    2009-07-08 08:35:26.04 Server      Authentication mode is MIXED.
    2009-07-08 08:35:26.04 Server      Logging SQL Server messages in file 'E:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\LOG\ERRORLOG'.
    2009-07-08 08:35:26.04 Server      This instance of SQL Server last reported using a process ID of 1840 at 7/8/2009 8:35:22 AM (local) 7/8/2009 1:35:22 PM (UTC). This is an informational message only; no user action is required.
    2009-07-08 08:35:26.04 Server      Registry startup parameters:
    2009-07-08 08:35:26.04 Server           -d E:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\DATA\master.mdf
    2009-07-08 08:35:26.04 Server           -e E:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\LOG\ERRORLOG
    2009-07-08 08:35:26.04 Server           -l E:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\DATA\mastlog.ldf
    2009-07-08 08:35:26.07 Server      SQL Server is starting at normal priority base (=7). This is an informational message only. No user action is required.
    2009-07-08 08:35:26.07 Server      Detected 2 CPUs. This is an informational message; no user action is required.
    2009-07-08 08:35:26.14 Server      Set AWE Enabled to 1 in the configuration parameters to allow use of more memory.
    2009-07-08 08:35:26.27 Server      Using dynamic lock allocation.  Initial allocation of 2500 Lock blocks and 5000 Lock Owner blocks per node.  This is an informational message only.  No user action is required.
    2009-07-08 08:35:26.30 Server      Attempting to initialize Microsoft Distributed Transaction Coordinator (MS DTC). This is an informational message only. No user action is required.
    2009-07-08 08:35:28.36 Server      Attempting to recover in-doubt distributed transactions involving Microsoft Distributed Transaction Coordinator (MS DTC). This is an informational message only. No user action is required.
    2009-07-08 08:35:28.36 Server      Database mirroring has been enabled on this instance of SQL Server.
    2009-07-08 08:35:28.36 spid5s      Starting up database 'master'.
    2009-07-08 08:35:28.45 spid5s      Recovery is writing a checkpoint in database 'master' (1). This is an informational message only. No user action is required.
    2009-07-08 08:35:28.60 spid5s      SQL Trace ID 1 was started by login "sa".
    2009-07-08 08:35:28.63 spid5s      Starting up database 'mssqlsystemresource'.
    2009-07-08 08:35:28.67 spid5s      The resource database build version is 9.00.4035. This is an informational message only. No user action is required.
    2009-07-08 08:35:28.86 spid5s      Server name is 'WCT-SHAREPOINT\WCTINTRANET'. This is an informational message only. No user action is required.
    2009-07-08 08:35:28.86 spid9s      Starting up database 'model'.
    2009-07-08 08:35:29.28 spid9s      Clearing tempdb database.
    2009-07-08 08:35:29.53 Server      A self-generated certificate was successfully loaded for encryption.
    2009-07-08 08:35:29.53 Server      Server is listening on [ 'any' <ipv4> 1240].
    2009-07-08 08:35:29.53 Server      Server local connection provider is ready to accept connection on [ \\.\pipe\SQLLocal\WCTINTRANET ].
    2009-07-08 08:35:29.53 Server      Server named pipe provider is ready to accept connection on [ \\.\pipe\MSSQL$WCTINTRANET\sql\query ].
    2009-07-08 08:35:29.54 Server      Server is listening on [ 127.0.0.1 <ipv4> 1241].
    2009-07-08 08:35:29.54 Server      Dedicated admin connection support was established for listening locally on port 1241.
    2009-07-08 08:35:29.56 Logon       Error: 17187, Severity: 16, State: 1.
    2009-07-08 08:35:29.56 Logon       SQL Server is not ready to accept new client connections. Wait a few minutes before trying again. If you have access to the error log, look for the informational message that indicates that SQL Server is ready before trying to connect again.  [CLIENT: 192.168.16.3]
    2009-07-08 08:35:29.56 Server      The SQL Network Interface library could not register the Service Principal Name (SPN) for the SQL Server service. Error: 0x2098, state: 15. Failure to register an SPN may cause integrated authentication to fall back to NTLM instead of Kerberos. This is an informational message. Further action is only required if Kerberos authentication is required by authentication policies.
    2009-07-08 08:35:29.56 Server      SQL Server is now ready for client connections. This is an informational message; no user action is required.
    2009-07-08 08:35:29.59 spid12s     Starting up database 'msdb'.
    2009-07-08 08:35:29.59 spid14s     Starting up database 'ReportServer$WCTIntranetTempDB'.
    2009-07-08 08:35:29.59 spid13s     Starting up database 'ReportServer$WCTIntranet'.
    2009-07-08 08:35:29.59 spid15s     Starting up database 'SharePoint_Config'.
    2009-07-08 08:35:29.59 spid16s     Starting up database 'SharePoint_AdminContent_fe6a6c5e-c6b4-401f-a07e-c39cb1ea2fe0'.
    2009-07-08 08:35:29.60 spid19s     Starting up database 'WSS_Content_7dcf783ae2574d489cd7d338f102fa44'.
    2009-07-08 08:35:29.60 spid17s     Starting up database 'WSS_Search_wct-sharepoint'.
    2009-07-08 08:35:29.60 spid18s     Starting up database 'WSS_Content'.
    2009-07-08 08:35:31.28 spid13s     CHECKDB for database 'ReportServer$WCTIntranet' finished without errors on 2009-06-29 23:31:53.360 (local time). This is an informational message only; no user action is required.
    2009-07-08 08:35:31.44 spid13s     Starting up database 'SharedServices1_DB'.
    2009-07-08 08:35:31.49 spid14s     CHECKDB for database 'ReportServer$WCTIntranetTempDB' finished without errors on 2009-06-29 23:31:53.993 (local time). This is an informational message only; no user action is required.
    2009-07-08 08:35:31.61 Logon       Error: 18456, Severity: 14, State: 16.
    2009-07-08 08:35:31.61 Logon       Login failed for user 'WHOOPER\sspsearchdb_acct'. [CLIENT: 192.168.16.3]
    2009-07-08 08:35:31.84 spid14s     Starting up database 'SharedServices1_Search_DB'.
    2009-07-08 08:35:31.85 Logon       Error: 18456, Severity: 14, State: 16.
    2009-07-08 08:35:31.85 Logon       Login failed for user 'WHOOPER\SQL2005'. [CLIENT: 192.168.16.3]
    2009-07-08 08:35:31.96 spid12s     Starting up database 'WSS_Content04132009'.
    2009-07-08 08:35:32.13 Logon       Error: 18456, Severity: 14, State: 16.
    2009-07-08 08:35:32.13 Logon       Login failed for user 'WHOOPER\SQL2005'. [CLIENT: 192.168.16.3]
    2009-07-08 08:35:33.66 spid13s     Recovery is writing a checkpoint in database 'SharedServices1_DB' (12). This is an informational message only. No user action is required.
    2009-07-08 08:35:33.79 spid9s      Starting up database 'tempdb'.
    2009-07-08 08:35:34.26 spid17s     Recovery is writing a checkpoint in database 'WSS_Search_wct-sharepoint' (9). This is an informational message only. No user action is required.
    2009-07-08 08:35:34.35 Logon       Error: 18456, Severity: 14, State: 16.
    2009-07-08 08:35:34.35 Logon       Login failed for user 'WHOOPER\SQL2005'. [CLIENT: <local machine>]
    2009-07-08 08:35:34.54 spid14s     Recovery is writing a checkpoint in database 'SharedServices1_Search_DB' (13). This is an informational message only. No user action is required.
    2009-07-08 08:35:34.83 spid13s     Starting up database 'WSS_Content04132009-2'.
    2009-07-08 08:35:35.10 spid17s     CHECKDB for database 'WSS_Search_wct-sharepoint' finished without errors on 2009-07-07 08:51:36.217 (local time). This is an informational message only; no user action is required.
    2009-07-08 08:35:35.24 spid17s     Starting up database 'wss_conten04132009-2'.
    2009-07-08 08:35:35.33 spid14s     CHECKDB for database 'SharedServices1_Search_DB' finished without errors on 2009-07-07 08:52:06.500 (local time). This is an informational message only; no user action is required.
    2009-07-08 08:35:35.58 spid14s     The Service Broker protocol transport is disabled or not configured.
    2009-07-08 08:35:35.58 spid14s     The Database Mirroring protocol transport is disabled or not configured.
    2009-07-08 08:35:36.16 spid18s     Recovery is writing a checkpoint in database 'WSS_Content' (10). This is an informational message only. No user action is required.
    2009-07-08 08:35:36.72 Logon       Error: 18456, Severity: 14, State: 16.
    2009-07-08 08:35:36.72 Logon       Login failed for user 'WHOOPER\SQL2005'. [CLIENT: 192.168.16.3]
    2009-07-08 08:35:36.72 spid19s     Recovery is writing a checkpoint in database 'WSS_Content_7dcf783ae2574d489cd7d338f102fa44' (11). This is an informational message only. No user action is required.
    2009-07-08 08:35:36.74 spid14s     Service Broker manager has started.
    2009-07-08 08:35:38.63 spid15s     Recovery is writing a checkpoint in database 'SharePoint_Config' (7). This is an informational message only. No user action is required.
    2009-07-08 08:35:39.12 Logon       Error: 18456, Severity: 14, State: 16.
    2009-07-08 08:35:39.12 Logon       Login failed for user 'WHOOPER\SQL2005'. [CLIENT: 192.168.16.3]
    2009-07-08 08:35:39.24 spid15s     CHECKDB for database 'SharePoint_Config' finished without errors on 2009-07-07 08:50:53.333 (local time). This is an informational message only; no user action is required.
    2009-07-08 08:35:40.90 spid13s     Recovery is writing a checkpoint in database 'WSS_Content04132009-2' (15). This is an informational message only. No user action is required.
    2009-07-08 08:35:40.93 spid12s     CHECKDB for database 'WSS_Content04132009' finished without errors on 2009-04-10 10:15:48.557 (local time). This is an informational message only; no user action is required.
    2009-07-08 08:35:41.06 spid13s     CHECKDB for database 'WSS_Content04132009-2' finished without errors on 2009-04-10 10:15:48.557 (local time). This is an informational message only; no user action is required.
    2009-07-08 08:35:41.07 spid5s      Recovery of any in-doubt distributed transactions involving Microsoft Distributed Transaction Coordinator (MS DTC) has completed. This is an informational message only. No user action is required.
    2009-07-08 08:35:41.07 spid5s      Recovery is complete. This is an informational message only. No user action is required.
    2009-07-08 08:35:41.70 spid60      Configuration option 'show advanced options' changed from 0 to 1. Run the RECONFIGURE statement to install.
    2009-07-08 08:35:41.74 spid60      Configuration option 'Agent XPs' changed from 0 to 1. Run the RECONFIGURE statement to install.
    2009-07-08 08:35:41.79 spid60      Configuration option 'show advanced options' changed from 1 to 0. Run the RECONFIGURE statement to install.
    2009-07-08 08:35:42.53 spid60      Using 'xpsqlbot.dll' version '2005.90.4035' to execute extended stored procedure 'xp_qv'. This is an informational message only; no user action is required.
    2009-07-08 08:35:43.09 spid60      Using 'xpstar90.dll' version '2005.90.4035' to execute extended stored procedure 'xp_instance_regread'. This is an informational message only; no user action is required.
    2009-07-08 08:35:43.31 spid60      Using 'xplog70.dll' version '2005.90.4035' to execute extended stored procedure 'xp_msver'. This is an informational message only; no user action is required.
    2009-07-08 08:36:00.69 Logon       Error: 18456, Severity: 14, State: 16.
    2009-07-08 08:36:00.69 Logon       Login failed for user 'WHOOPER\SQL2005'. [CLIENT: <local machine>]
    2009-07-08 08:37:00.37 Logon       Error: 18456, Severity: 14, State: 16.
    2009-07-08 08:37:00.37 Logon       Login failed for user 'WHOOPER\SQL2005'. [CLIENT: <local machine>]
    2009-07-08 08:38:00.39 Logon       Error: 18456, Severity: 14, State: 16.
    2009-07-08 08:38:00.39 Logon       Login failed for user 'WHOOPER\SQL2005'. [CLIENT: <local machine>]
    2009-07-08 08:39:00.42 Logon       Error: 18456, Severity: 14, State: 16.
    2009-07-08 08:39:00.42 Logon       Login failed for user 'WHOOPER\SQL2005'. [CLIENT: <local machine>]
    2009-07-08 08:40:00.44 Logon       Error: 18456, Severity: 14, State: 16.
    2009-07-08 08:40:00.44 Logon       Login failed for user 'WHOOPER\SQL2005'. [CLIENT: <local machine>]
    2009-07-08 08:41:00.46 Logon       Error: 18456, Severity: 14, State: 16.
    2009-07-08 08:41:00.46 Logon       Login failed for user 'WHOOPER\SQL2005'. [CLIENT: <local machine>]
    2009-07-08 08:42:00.48 Logon       Error: 18456, Severity: 14, State: 16.
    2009-07-08 08:42:00.48 Logon       Login failed for user 'WHOOPER\SQL2005'. [CLIENT: <local machine>]
    2009-07-08 08:43:00.51 Logon       Error: 18456, Severity: 14, State: 16.
    2009-07-08 08:43:00.51 Logon       Login failed for user 'WHOOPER\SQL2005'. [CLIENT: <local machine>]
    2009-07-08 08:44:00.54 Logon       Error: 18456, Severity: 14, State: 16.
    2009-07-08 08:44:00.54 Logon       Login failed for user 'WHOOPER\SQL2005'. [CLIENT: <local machine>]
    2009-07-08 08:45:00.54 Logon       Error: 18456, Severity: 14, State: 16.
    2009-07-08 08:45:00.54 Logon       Login failed for user 'WHOOPER\SQL2005'. [CLIENT: <local machine>]
    2009-07-08 08:46:00.57 Logon       Error: 18456, Severity: 14, State: 16.
    2009-07-08 08:46:00.57 Logon       Login failed for user 'WHOOPER\SQL2005'. [CLIENT: <local machine>]
    2009-07-08 08:47:00.58 Logon       Error: 18456, Severity: 14, State: 16.
    2009-07-08 08:47:00.58 Logon       Login failed for user 'WHOOPER\SQL2005'. [CLIENT: <local machine>]
    2009-07-08 08:48:00.61 Logon       Error: 18456, Severity: 14, State: 16.
    2009-07-08 08:48:00.61 Logon       Login failed for user 'WHOOPER\SQL2005'. [CLIENT: <local machine>]



    ERRORLOG.1 file
    (this is the last of literlly dozens of entries since mid-morning yesterday (7 July):
    2009-07-08 08:35:00.45 Logon       Error: 18456, Severity: 14, State: 16.
    2009-07-08 08:35:00.45 Logon       Login failed for user 'WHOOPER\SQL2005'. [CLIENT: <local machine>]
    Mike Webb, IT Admin, Platte River Whooping Crane Maintenance Trust, Inc. (a 501(c)(3) conservation nonprofit org.)
    Wednesday, July 08, 2009 1:49 PM
  •  

    Hi Mike,

     

    Thanks for your cooperation.

     

    I noticed the error source came from the local machine.

     

    If the machine is dedicated database server and do not host SharePoint product, I suppose there were SQL Server agent job that was schedule to run every one minute and cause the error.

     

    Could you please check the SQL Server Agent > Jobs in the SQL Server Management Studio?

    In my local environment, there is a SSPDatabaseName_Job_DeleteExpiredSessions job and it was schedule to run every one minute.

     

    If the similar job existed in your environment, please check whether the database the job was configured exists or not.

    If the database was not existed, you could disable or delete the job to resolve the issue.

     

    Let me know the result if possible.

    -lambert


    Sincerely,
    Lambert Qin | Microsoft TechNet Managed Forum Support
    Posting is provided "AS IS" with no warranties, and confers no rights.
    Thursday, July 09, 2009 5:40 AM
  • I found a job that did not have a corresponding database.  I deleted it and the login errors stopped.

    Thanks.

    Mike Webb, IT Admin, Platte River Whooping Crane Maintenance Trust, Inc. (a 501(c)(3) conservation nonprofit org.)
    Thursday, July 09, 2009 1:26 PM