locked
" Login failed for user 'NT AUTHORITY\ANONYMOUS LOGON' " error after installing FCS to an XP Client RRS feed

  • Question

  • I'm seeing lots of below errors from one of the clients. I tried removing and reinstalling FCS client a few times with no luck.
     
    Domain: MYDOMAIN
    Computer: WRKS1
    Time: 8/24/2007 10:36:43 AM
    Type: Error
    Provider Name: Script-generated Data
    Event Number: 20103
    Provider Type: Generic Provider
    Source: Microsoft Forefront Client Security
    Category:
    Raises Alert: True
    Consolidated:
    From:
    To:
    Event Id: 6506cf23-17c2-4c31-b012-e254610799a8
    Description:
    Failed to connect to database.
    Connection string: Server=MOM05SERVER;Database=Onepoint;Trusted_Connection=yes;
    Error code: -2147217843
    Error description: Login failed for user 'NT AUTHORITY\ANONYMOUS LOGON'.
     
     
    Any ideas?

     

    Friday, August 24, 2007 6:03 PM

All replies

  • Is the machine WRKS1 in the same domain as MOM05SERVER?

     

    Friday, August 24, 2007 6:13 PM
  • Yes it is...

     

    Friday, August 24, 2007 6:36 PM
  • Perhaps try unjoining and rejoining the machine? Usually it only reverts to anonymous credentials when it cannot validate the client using a trusted connection.

     

    Friday, August 24, 2007 6:43 PM
  •  

    I just removed the ws from domain and re-joined it, still same error and 2 similar errors (below).

     

    -----------------

     

    Name: Client Security Script Failed to Connect to the Collection Database
    Severity: Error
    Resolution State: New
    Domain: MYDOMAIN
    Computer: WRKS1
    Time of First Event: 8/23/2007 2:49:36 PM
    Time of Last Event: 8/24/2007 2:49:42 PM
    Alert latency: 0 sec
    Problem State: Investigate
    Repeat Count: 24
    Age:
    Source: Microsoft Forefront Client Security Microsoft Forefront Client Security Script Name = Microsoft Forefront Client Security - Event flood detection Error Number = -2147217843
    Alert Id: c4a98985-dfc4-483b-9511-049b335cf25f
    Rule (enabled): Microsoft Forefront Client Security\Common Rules\Client Security Script Failed to Connect to the Collection Database

    Description:
    When the MOM server processed a Client Security script, the script failed to connect to the collection database (MOM database).
    - Error code: -2147217843
    - Error description: Login failed for user 'NT AUTHORITY\ANONYMOUS LOGON'.
    - Connection string: Server=MOM05SERVER;Database=Onepoint;Trusted_Connection=yes;
    - Rule name: Run Flood Detection
    - Script name: Microsoft Forefront Client Security - Event flood detection

    To investigate and resolve this incident, make sure that the collection database is running and that the MOM Action Account has permission to access it.

    For more information, refer to the Product Knowledge tab.
     
    --------------
     
    Name: Client Security Script Failed to Connect to the Collection Database
    Severity: Error
    Resolution State: Acknowledged
    Domain: MYDOMAIN
    Computer: WRKS1
    Time of First Event: 8/23/2007 2:50:31 PM
    Time of Last Event: 8/24/2007 2:51:26 PM
    Alert latency: 0 sec
    Problem State: Investigate
    Repeat Count: 575
    Age:
    Source: Microsoft Forefront Client Security Microsoft Forefront Client Security Script Name = Microsoft Forefront Client Security - Malicious Software Outbreak Error Number = -2147217843
    Alert Id: 44714464-9636-4d0f-bb8b-a5f9ca54b00b
    Rule (enabled): Microsoft Forefront Client Security\Common Rules\Client Security Script Failed to Connect to the Collection Database
    Description:
    When the MOM server processed a Client Security script, the script failed to connect to the collection database (MOM database).
    - Error code: -2147217843
    - Error description: Login failed for user 'NT AUTHORITY\ANONYMOUS LOGON'.
    - Connection string: Server=MOM05SERVER;Database=Onepoint;Trusted_Connection=yes;
    - Rule name: Malware Outbreak Parameters - Time Slot 4
    - Script name: Microsoft Forefront Client Security - Malicious Software Outbreak

    To investigate and resolve this incident, make sure that the collection database is running and that the MOM Action Account has permission to access it.

    For more information, refer to the Product Knowledge tab.
     
    Friday, August 24, 2007 9:54 PM