Post reply

Problem with login (Login failed for user NT AUTHORITY\SYSTEM.)

  • October 15, 2004 at 11:24 am

    #163449

    Hello Everyone,

    I'm having a puzzling problem.  After reviewing my sql logs I see this entry every 1 to 5 minutes.  Login failed for user 'NT AUTHORITY\SYSTEM'.

    I have checked all my jobs and they run under the sa account.  I have checked both the sql server and sql agent service accounts and they start under a domain account that is also a local server administrator and a sql server administrator as well.  I have not linked servers either.

    I did remove the BUILTIN\Administrator account a couple of days ago but I ruled that out as a cause since the problem has been occurring for over a month now and I removed the BUILTIN\Administrator sql account five days ago.

    I'm pretty much stumped now.  Anyone else run into this before?

    Jerry

     

  • October 15, 2004 at 11:52 am

    #526938

    Did you try running profiler to see what was attempting to logon?  You could also see if adding the BUILTIN\Admin back in fixes it. Just to elimate that as a potential problem.


    Darren

  • October 15, 2004 at 12:32 pm

    #526946

    Do you have full-text indexing installed? Is SQL Server Agent running under the System account (you can check this by running services.msc and looking at the login account).

    NT Authority\System corresponds to the local system account and if either of the above is true you'll need to add it as a login and grant it sysadmin server role membership. You don't need to grant BUILTIN\Administrators access again. However, when you removed it, the local System account lost its ability to log into SQL Server.

    K. Brian Kelley
    @kbriankelley

  • October 16, 2004 at 2:26 am

    #526974

     

    It has to be related to the shadow copy. It may not the exact problem that you are experiencing but similar.  The KBB article is 828481. shadow copy trying to access the database files when the NT Backup was starting.  Try to disable this feature using the following switch:  /SNAPFF.  You may no longer receive the login failure alerts.

  • June 2, 2008 at 8:31 am

    #822965

    So, if third-party backup needs to log-in as nt authority\system, it's advisable to just add this login, instead of re-adding builtin\admin? Thanks.

    Chris

  • June 2, 2008 at 12:58 pm

    #823221

    Yes just add the System account back. It minimizes the number of accounts with access, especially with sysadmin access.

    K. Brian Kelley
    @kbriankelley

  • June 2, 2008 at 1:16 pm

    #823244

    Thanks, Brian.

Viewing 7 posts - 1 through 6 (of 6 total)

You must be logged in to reply to this topic. Login to reply