Articles > Windows 2003
Printer Friendly Version
Views: 5083

SQL Failure Audit in Application Logs with Computername

Last Updated: 1/8/09

If you get an error similiar to the one below:

Event Type:	Failure Audit
Event Source:	MSSQLSERVER
Event Category:	(4)
Event ID:	18456
Date:		1/8/2009
Time:		11:24:16 AM
User:		DOMAIN\REMOTECOMPUTERNAME$
Computer:	SQLCOMPUTERNAME
Description:
Login failed for user 'DOMAIN\REMOTECOMPUTERNAME$.
 [CLIENT: xxx.xxx.xxx.xxx]

For more information, see Help and Support Center 
at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 18 48 00 00 0e 00 00 00   .H......
0008: 06 00 00 00 50 00 4c 00   ....S.Q.
0010: 55 00 54 00 4f 00 00 00   L.....
0018: 07 00 00 00 6d 00 61 00   ....m.a.
0020: 73 00 74 00 65 00 72 00   s.t.e.r.
0028: 00 00                     ..      
Cause:
Often this is caused by a service trying to communicate with the SQL server. There are a few solutions.

Solution:
You can either create a login for the computer name and then assign rights to the correct database to that user like this:

CREATE LOGIN [abc\xyz$] FROM WINDOWS

or you can change the user that is running the service from the remote computer. Just go to Start > Run > type "services.msc" and then change the login for that service.



Keywords: sql server 2000 2005 application failure audit with computer name windows 2003