none
MOSS event ID 3351 Login failed for user 'NT AUTHORITY\ANONYMOUS LOGON'

    Question

  •  

    Hi,

    I've got a lot of 3351 events in my event viewer, every day at the same hour (23:00PM, 2:00AM, 16:30PM). I've tried to restart services and web aplication, but it doesn't help.

    SQL database login failed. Additional error information from SQL Server is included below.

    Login failed for user 'NT AUTHORITY\ANONYMOUS LOGON'.

    Please help

    My log file:

    02/11/2009 02:00:04.87  SPWRITER.EXE (0x08F4)                    0x0720 Windows SharePoint Services    Database                       880i High     System.Data.SqlClient.SqlException: Login failed for user 'NT AUTHORITY\ANONYMOUS LOGON'.     at System.Data.SqlClient.SqlInternalConnection.OnError(SqlException exception, Boolean breakConnection)     at System.Data.SqlClient.TdsParser.ThrowExceptionAndWarning(TdsParserStateObject stateObj)     at System.Data.SqlClient.TdsParser.Run(RunBehavior runBehavior, SqlCommand cmdHandler, SqlDataReader dataStream, BulkCopySimpleResultSet bulkCopyHandler, TdsParserStateObject stateObj)     at System.Data.SqlClient.SqlInternalConnectionTds.CompleteLogin(Boolean enlistOK)     at System.Data.SqlClient.SqlInternalConnectionTds.LoginNoFailover(String host, String newPassword, Boolean redirectedUserInstance, SqlConnection owningObject, SqlConnectionString connectionOptions, Int64 timerStart)     at Syste... 
    02/11/2009 02:00:04.87* SPWRITER.EXE (0x08F4)                    0x0720 Windows SharePoint Services    Database                       880i High     ...m.Data.SqlClient.SqlInternalConnectionTds.OpenLoginEnlist(SqlConnection owningObject, SqlConnectionString connectionOptions, String newPassword, Boolean redirectedUserInstance)     at System.Data.SqlClient.SqlInternalConnectionTds..ctor(DbConnectionPoolIdentity identity, SqlConnectionString connectionOptions, Object providerInfo, String newPassword, SqlConnection owningObject, Boolean redirectedUserInstance)     at System.Data.SqlClient.SqlConnectionFactory.CreateConnection(DbConnectionOptions options, Object poolGroupProviderInfo, DbConnectionPool pool, DbConnection owningConnection)     at System.Data.ProviderBase.DbConnectionFactory.CreatePooledConnection(DbConnection owningConnection, DbConnectionPool pool, DbConnectionOptions options)     at System.Data.ProviderBase.DbConnectionPool.C... 
    02/11/2009 02:00:04.87* SPWRITER.EXE (0x08F4)                    0x0720 Windows SharePoint Services    Database                       880i High     ...reateObject(DbConnection owningObject)     at System.Data.ProviderBase.DbConnectionPool.UserCreateRequest(DbConnection owningObject)     at System.Data.ProviderBase.DbConnectionPool.GetConnection(DbConnection owningObject)     at System.Data.ProviderBase.DbConnectionFactory.GetConnection(DbConnection owningConnection)     at System.Data.ProviderBase.DbConnectionClosed.OpenConnection(DbConnection outerConnection, DbConnectionFactory connectionFactory)     at System.Data.SqlClient.SqlConnection.Open()     at Microsoft.SharePoint.Utilities.SqlSession.OpenConnection() 
    02/11/2009 02:00:04.87  SPWRITER.EXE (0x08F4)                    0x0720 Windows SharePoint Services    Database                       880j High     SqlError: 'Login failed for user 'NT AUTHORITY\ANONYMOUS LOGON'.'    Source: '.Net SqlClient Data Provider' Number: 18456 State: 1 Class: 14 Procedure: '' LineNumber: 65536 Server: 'nero\moss' 
    02/11/2009 02:00:04.87  SPWRITER.EXE (0x08F4)                    0x0720 Windows SharePoint Services    Database                       6y64 Critical SQL database login failed. Additional error information from SQL Server is included below.  Login failed for user 'NT AUTHORITY\ANONYMOUS LOGON'. 
    02/11/2009 02:00:04.89  SPWRITER.EXE (0x08F4)                    0x0720 Windows SharePoint Services    Database                       880k High        at Microsoft.SharePoint.Utilities.SqlSession.ExecuteReader(SqlCommand command, CommandBehavior behavior)     at Microsoft.SharePoint.Administration.SPConfigurationDatabase.FetchId(QualifiedObjectName qName)     at Microsoft.SharePoint.Administration.SPConfigurationDatabase.GetObject(String name, Guid parentId, Type type)     at Microsoft.SharePoint.Administration.SPConfigurationDatabase.get_Farm()     at Microsoft.SharePoint.Administration.SPConfigurationDatabase.SPFileSystemCacheWatcher.OnChanged(Object source, FileSystemEventArgs e)     at System.IO.FileSystemWatcher.CompletionStatusChanged(UInt32 errorCode, UInt32 numBytes, NativeOverlapped* overlappedPointer)     at System.Threading._IOCompletionCallback.PerformIOCompletionCallback(UInt32 errorCode, UInt32 numBytes, NativeOverlapped... 
    02/11/2009 02:00:04.89  SPWRITER.EXE (0x08F4)                    0x0720 Windows SharePoint Services    Database                       880k High        at Microsoft.SharePoint.Utilities.SqlSession.ExecuteReader(SqlCommand command, CommandBehavior behavior)     at Microsoft.SharePoint.Administration.SPConfigurationDatabase.FetchId(QualifiedObjectName qName)     at Microsoft.SharePoint.Administration.SPConfigurationDatabase.GetObject(String name, Guid parentId, Type type)     at Microsoft.SharePoint.Administration.SPConfigurationDatabase.get_Farm()     at Microsoft.SharePoint.Administration.SPConfigurationDatabase.SPFileSystemCacheWatcher.OnChanged(Object source, FileSystemEventArgs e)     at System.IO.FileSystemWatcher.CompletionStatusChanged(UInt32 errorCode, UInt32 numBytes, NativeOverlapped* overlappedPointer)     at System.Threading._IOCompletionCallback.PerformIOCompletionCallback(UInt32 errorCode, UInt32 numBytes, NativeOverlapped... 
    02/11/2009 02:00:04.89* SPWRITER.EXE (0x08F4)                    0x0720 Windows SharePoint Services    Database                       880k High     ...* pOVERLAP)   
    02/11/2009 02:00:04.89* SPWRITER.EXE (0x08F4)                    0x0720 Windows SharePoint Services    Database                       880k High     ...* pOVERLAP)   
    02/11/2009 02:00:04.89  SPWRITER.EXE (0x08F4)                    0x0720 Windows SharePoint Services    Database                       880l High     ConnectionString: 'Data Source=nero\moss;Initial Catalog=SharePoint_Config;Integrated Security=True;Enlist=False'    ConnectionState: Closed ConnectionTimeout: 15 
    02/11/2009 02:00:04.89  SPWRITER.EXE (0x08F4)                    0x0720 Windows SharePoint Services    Database                       880l High     ConnectionString: 'Data Source=nero\moss;Initial Catalog=SharePoint_Config;Integrated Security=True;Enlist=False'    ConnectionState: Closed ConnectionTimeout: 15 
    02/11/2009 02:00:04.89  SPWRITER.EXE (0x08F4)                    0x0720 Windows SharePoint Services    Topology                       888j Medium   System.Data.SqlClient.SqlException: Login failed for user 'NT AUTHORITY\ANONYMOUS LOGON'.     at System.Data.SqlClient.SqlInternalConnection.OnError(SqlException exception, Boolean breakConnection)     at System.Data.SqlClient.TdsParser.ThrowExceptionAndWarning(TdsParserStateObject stateObj)     at System.Data.SqlClient.TdsParser.Run(RunBehavior runBehavior, SqlCommand cmdHandler, SqlDataReader dataStream, BulkCopySimpleResultSet bulkCopyHandler, TdsParserStateObject stateObj)     at System.Data.SqlClient.SqlInternalConnectionTds.CompleteLogin(Boolean enlistOK)     at System.Data.SqlClient.SqlInternalConnectionTds.LoginNoFailover(String host, String newPassword, Boolean redirectedUserInstance, SqlConnection owningObject, SqlConnectionString connectionOptions, Int64 timerStart)     at Syste... 
    02/11/2009 02:00:04.89  SPWRITER.EXE (0x08F4)                    0x0720 Windows SharePoint Services    Topology                       888j Medium   System.Data.SqlClient.SqlException: Login failed for user 'NT AUTHORITY\ANONYMOUS LOGON'.     at System.Data.ProviderBase.DbConnectionPool.GetConnection(DbConnection owningObject)     at System.Data.ProviderBase.DbConnectionFactory.GetConnection(DbConnection owningConnection)     at System.Data.ProviderBase.DbConnectionClosed.OpenConnection(DbConnection outerConnection, DbConnectionFactory connectionFactory)     at System.Data.SqlClient.SqlConnection.Open()     at Microsoft.SharePoint.Utilities.SqlSession.OpenConnection()     at Microsoft.SharePoint.Utilities.SqlSession.ExecuteReader(SqlCommand command, CommandBehavior behavior)     at Microsoft.SharePoint.Administration.SPConfigurationDatabase.FetchId(QualifiedObjectName qName)     at Microsoft.SharePoint.Administration.SPConfigurationDat... 
    02/11/2009 02:00:04.89* SPWRITER.EXE (0x08F4)                    0x0720 Windows SharePoint Services    Topology                       888j Medium   ...m.Data.SqlClient.SqlInternalConnectionTds.OpenLoginEnlist(SqlConnection owningObject, SqlConnectionString connectionOptions, String newPassword, Boolean redirectedUserInstance)     at System.Data.SqlClient.SqlInternalConnectionTds..ctor(DbConnectionPoolIdentity identity, SqlConnectionString connectionOptions, Object providerInfo, String newPassword, SqlConnection owningObject, Boolean redirectedUserInstance)     at System.Data.SqlClient.SqlConnectionFactory.CreateConnection(DbConnectionOptions options, Object poolGroupProviderInfo, DbConnectionPool pool, DbConnection owningConnection)     at System.Data.ProviderBase.DbConnectionFactory.CreatePooledConnection(DbConnection owningConnection, DbConnectionPool pool, DbConnectionOptions options)     at System.Data.ProviderBase.DbConnectionPool.C... 
    02/11/2009 02:00:04.89* SPWRITER.EXE (0x08F4)                    0x0720 Windows SharePoint Services    Topology                       888j Medium   ...abase.GetObject(String name, Guid parentId, Type type)     at Microsoft.SharePoint.Administration.SPConfigurationDatabase.get_Farm()     at Microsoft.SharePoint.Administration.SPConfigurationDatabase.SPFileSystemCacheWatcher.OnChanged(Object source, FileSystemEventArgs e) 
    02/11/2009 02:00:04.89* SPWRITER.EXE (0x08F4)                    0x0720 Windows SharePoint Services    Topology                       888j Medium   ...reateObject(DbConnection owningObject)     at System.Data.ProviderBase.DbConnectionPool.UserCreateRequest(DbConnection owningObject)     at System.Data.ProviderBase.DbConnectionPool.GetConnection(DbConnection owningObject)     at System.Data.ProviderBase.DbConnectionFactory.GetConnection(DbConnection owningConnection)     at System.Data.ProviderBase.DbConnectionClosed.OpenConnection(DbConnection outerConnection, DbConnectionFactory connectionFactory)     at System.Data.SqlClient.SqlConnection.Open()     at Microsoft.SharePoint.Utilities.SqlSession.OpenConnection()     at Microsoft.SharePoint.Utilities.SqlSession.ExecuteReader(SqlCommand command, CommandBehavior behavior)     at Microsoft.SharePoint.Administration.SPConfigurationDatabase.FetchId(QualifiedObjectName qName)     at Microsoft.S... 
    02/11/2009 02:00:04.89  SPWRITER.EXE (0x08F4)                    0x0720 Windows SharePoint Services    Database                       880i High     System.Data.SqlClient.SqlException: Login failed for user 'NT AUTHORITY\ANONYMOUS LOGON'.     at System.Data.ProviderBase.DbConnectionPool.GetConnection(DbConnection owningObject)     at System.Data.ProviderBase.DbConnectionFactory.GetConnection(DbConnection owningConnection)     at System.Data.ProviderBase.DbConnectionClosed.OpenConnection(DbConnection outerConnection, DbConnectionFactory connectionFactory)     at System.Data.SqlClient.SqlConnection.Open()     at Microsoft.SharePoint.Utilities.SqlSession.OpenConnection() 
    02/11/2009 02:00:04.89* SPWRITER.EXE (0x08F4)                    0x0720 Windows SharePoint Services    Topology                       888j Medium   ...harePoint.Administration.SPConfigurationDatabase.GetObject(String name, Guid parentId, Type type)     at Microsoft.SharePoint.Administration.SPConfigurationDatabase.get_Farm()     at Microsoft.SharePoint.Administration.SPConfigurationDatabase.SPFileSystemCacheWatcher.OnChanged(Object source, FileSystemEventArgs e) 
    02/11/2009 02:00:04.89  SPWRITER.EXE (0x08F4)                    0x0720 Windows SharePoint Services    Database                       880j High     SqlError: 'Login failed for user 'NT AUTHORITY\ANONYMOUS LOGON'.'    Source: '.Net SqlClient Data Provider' Number: 18456 State: 1 Class: 14 Procedure: '' LineNumber: 65536 Server: 'nero\moss' 
    02/11/2009 02:00:04.89  SPWRITER.EXE (0x08F4)                    0x0720 Windows SharePoint Services    Database                       880i High     System.Data.SqlClient.SqlException: Login failed for user 'NT AUTHORITY\ANONYMOUS LOGON'.     at System.Data.ProviderBase.DbConnectionPool.GetConnection(DbConnection owningObject)     at System.Data.ProviderBase.DbConnectionFactory.GetConnection(DbConnection owningConnection)     at System.Data.ProviderBase.DbConnectionClosed.OpenConnection(DbConnection outerConnection, DbConnectionFactory connectionFactory)     at System.Data.SqlClient.SqlConnection.Open()     at Microsoft.SharePoint.Utilities.SqlSession.OpenConnection() 
    02/11/2009 02:00:04.89  SPWRITER.EXE (0x08F4)                    0x0720 Windows SharePoint Services    Database                       6y64 Critical SQL database login failed. Additional error information from SQL Server is included below.  Login failed for user 'NT AUTHORITY\ANONYMOUS LOGON'. 
    02/11/2009 02:00:04.89  SPWRITER.EXE (0x08F4)                    0x0720 Windows SharePoint Services    Database                       880j High     SqlError: 'Login failed for user 'NT AUTHORITY\ANONYMOUS LOGON'.'    Source: '.Net SqlClient Data Provider' Number: 18456 State: 1 Class: 14 Procedure: '' LineNumber: 65536 Server: 'nero\moss' 

     

    tnx

    klemen

    Wednesday, February 11, 2009 7:07 AM

Answers

  •  

    Hi, Running Windows sharepoint services vss writer service under AD farm account (instead of Local system) is the solution of my issue! I'm so happy :) Tnx, Klemen

    • Marked as answer by Klemen30 Monday, March 02, 2009 8:07 AM
    Monday, March 02, 2009 8:07 AM

All replies

  • Check if this article from MSDN helps:
    http://technet.microsoft.com/en-us/library/cc561068.aspx

    --
    Madhur

    http://blogs.msdn.com/mahuja
    Wednesday, February 11, 2009 8:46 AM
  • Hi, 

    Service accounts and security rights on databases are OK, in fact everything is working fine, but I want to get rid of 3351 events.... it seems I've got hundreds of them in my event viewer...

    tnx
    klemen
    Wednesday, February 11, 2009 11:11 AM
  • Wednesday, February 11, 2009 1:47 PM
  •  

    Hi,

    Please check the account name of the application pool of the portal site to see if it is a domain account. If not, reset the application pool account to the domain account to see if it works.

    Please let me know if there is any misunderstanding. Thanks!

    Lu Zou

    Thursday, February 12, 2009 7:29 AM
  • Hi,

    I've noticed that event 3351 pops up  even during backup (STSADM), but backup completed OK.

    So, I followed the instructions in thread http://social.technet.microsoft.com/Forums/en-US/sharepointadmin/thread/af528a14-057c-464e-bfd9-4582121d16d0/ 
    and run command line   psconfig.exe -cmd secureresources
    Than I restarted my web front end server and run backup again for test. The event 3351 is not showing durig backup anymore!
    It's posible that PSCONFIG is the solution... well I'll have to wait till tomorrow morning and check my event viewer.

    tnx,

    klemen
    • Proposed as answer by Lu Zou-MSFT Thursday, February 12, 2009 9:13 AM
    • Marked as answer by Lu Zou-MSFT Friday, February 13, 2009 5:55 AM
    • Unmarked as answer by Lu Zou-MSFT Friday, February 13, 2009 9:45 AM
    • Unproposed as answer by Lu Zou-MSFT Friday, February 13, 2009 9:45 AM
    Thursday, February 12, 2009 8:21 AM
  •  

    Unfortunately, this is not the solution, 3351 events are back  (20:30PM, 1:30AM, 2:00AM)

    :(

    tnx

    klemen

    Friday, February 13, 2009 9:12 AM
  • Hi

    Could you check the account name of the application pool of the portal site again and do the steps in the article below to see if this can work?

    http://technet.microsoft.com/en-us/library/cc561068.aspx

    Lu Zou
    Tuesday, February 17, 2009 11:04 AM
  • All web application accounts are OK. Event ID 3351 pops up at 20:30PM (backup with CA ARC Serve Sharepoint agent), at 1:20AM (backup with STSADM command) and 2:00AM (I can't figure it out what's going on at 2:00AM ?).
    Both backups are done without any error.

    tnx,
    klemen
    Friday, February 20, 2009 11:47 AM
  • Hi,

    Every time I run backup (from central  administration or STSADM or CA ARCServe) event 3351 pops up on web front end server and event 18456 on SQL server. All backups are done without errors.
    I've tried to update accounts http://support.microsoft.com/default.aspx/kb/934838 , but no luck.

    Is there any solution?

    tnx
    klemen
    Wednesday, February 25, 2009 8:50 AM
  •  

    Hi, Running Windows sharepoint services vss writer service under AD farm account (instead of Local system) is the solution of my issue! I'm so happy :) Tnx, Klemen

    • Marked as answer by Klemen30 Monday, March 02, 2009 8:07 AM
    Monday, March 02, 2009 8:07 AM
  • All web application accounts are OK. Event ID 3351 pops up at 20:30PM (backup with CA ARC Serve Sharepoint agent), at 1:20AM (backup with STSADM command) and 2:00AM (I can't figure it out what's going on at 2:00AM ?).
    Both backups are done without any error.

    tnx,
    klemen

    Dear Klemen,

    Glad to know that your isue was resolve. I have a similar issue and I would like to check with you whether you resolve the issue at 2.00AM? I'm also stuck here and would like to find out which job is doing it at 2.00AM.


    Thanks and best regards, Kim Seng This posting is provided "AS IS" with no warranties or guarantees , and confers no rights.

    Thursday, March 14, 2013 9:13 AM