-
Title
There is no user login name associated with failed logon attempt for SQL event -
Description
There is no user login name associated with failed logon attempt for SQL event. You may see event similar to the following:
"When: 4/17/2012 7:20:15 PM
Severity: Medium Severity
Who:
What: The user <loginname> tried to log in to the SQL Server Server1\MSSQLSERVER and failed.
Action: Other
Result: None
From: <Not Set>
To: <Not Set>
Where: Server1
Source: ChangeAuditor
Origin: Server2 (x.x.x.x)
Facility: SQL Security Audit Event
Subsystem: SQL" -
Cause
There may be an application,etc.. which has blank login credentials specified or the authentication mode set for the SQL instance does not allow "SQL authentication+Windows Authentication" and only "Windows Authentication".
-
Resolution
Investigate the SQL error logs for the matching failed login attempt which also will not include login name (example below):
"2011-04-25 16:01:58.54 Logon Login failed for user ''. Reason: The user is not associated with a trusted SQL Server connection. [CLIENT: x.x.x.x]"
Under such conditions the events reported in ChangeAuditor are expected.