none
EVENT ID 18456 STATE: 16 Login failed for user 'DOMAIN/user'. [CLIENT: <local machine>] every minute in event log.

    Question

  • We recently upgraded to SQL 2005 from SQL 2000.  We have most of our issues ironed out however about every 1 minute there is a message in the Application Event log and the SQL log that states:

     

    EVENT ID 18456  Login Failed for the users  DOMAIN/ACCOUNT  [CLIENT: <local machine>]

     

    This is a state 16 message which I thought meant that the account does not have access to the default database.  The account is actually the account that the SQL services run under.

     

    Any ideas?  We can't seem to figure this one out.  We actually upgraded to 2005 from 2000 and had an error appear after every reboot that prevented the SQL Agent from running(This application has failed to start because GAPI32.dll was not found. Re-installing the application may fix this problem.)  We did a full uninstall of SQL and reinstalled fresh and restored the databases from .bak files and that is when the EVENT ID 18546 started occuring every minute.

     

    We don't have any SQL heavy hitters here so please be detailed with any possible solutions.  That you very much for any help you can provide!

     

    David

    Monday, October 22, 2007 2:14 PM

Answers

  • state=16 means that the incoming user does not have permissions to log into the target database. SInce you have migrated the database from 2000 to 2005, the User to Login mapping might have broken (Orphaned User). Remap the login to user or drop and re-add the user to the database and see...

     

     Madhu

     

    Thursday, November 29, 2007 2:07 AM

All replies

  • Check out Microsoft kb 925744 re: error message 18456. I hope it is helpful.

    Addison
    Wednesday, November 28, 2007 9:47 PM
  • state=16 means that the incoming user does not have permissions to log into the target database. SInce you have migrated the database from 2000 to 2005, the User to Login mapping might have broken (Orphaned User). Remap the login to user or drop and re-add the user to the database and see...

     

     Madhu

     

    Thursday, November 29, 2007 2:07 AM
  •  

    I found that I had this message when I had jobs failing because they were pointing to databases that no longer existed. These were Sharepoint cleanup jobs actually, and they were referring to SharePoint databases that had been deleted. They were also running once per minute.

     

    Mike

    Thursday, February 07, 2008 7:47 PM
  • I had this same problem and I fixed it by looking at the SQL Server Profiler.  This will give you the name of the Application that is trying to gain access, but is being denied.  In my case it was Ultrasound, which before I reformatted and Upgraded to SQL 2005 this was a DC.  I disabled it and now do not see any errors.

     

    Tuesday, March 11, 2008 8:04 PM