Wednesday, January 2, 2008

“Failure Audit” in a SQL Server 2005

Today I have found this error in my event viewer:

Event Type:    Failure Audit
Event Source:    MSSQLSERVER
Event Category:    (4)
Event ID:    18456
Date:        03/01/2008
Time:        03:20:01
User:        DEMOSS2007\Admin
Computer:    DEMOSS2007
Description:
Login failed for user 'DEMOSS2007\Admin'. [CLIENT: <local machine>]

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 18 48 00 00 0e 00 00 00 .H......
0008: 0b 00 00 00 44 00 45 00 ....D.E.
0010: 4d 00 4f 00 53 00 53 00 M.O.S.S.
0018: 32 00 30 00 30 00 37 00 2.0.0.7.
0020: 00 00 07 00 00 00 6d 00 ......m.
0028: 61 00 73 00 74 00 65 00 a.s.t.e.
0030: 72 00 00 00 r...

I encountered this same issue after a MOSS uninstall. Thanks to this post I have discovered that the SQL Job associated to a deleted SSP is not deleted in the SQL Agent and it cause the event viewer error. Disabling or deleting this job will fix the issue. I have not checked if this issue is fixed in the SP1.

Related Links:
http://www.virtual-generations.com/2007/01/28/sharepoint-and-sql-server-error-18456/ (Read the Update 3)

 
Online Visitors