locked
Abnormal SSPI Handshake error messages in Error Log RRS feed

  • Question

  • On one of our production servers last night I got these 2 error messages at 11:01:00PM, 11:01:05PM, 11:01:10PM, and 11:01:15PM (all 5 seconds apart) and then it went away.  I am trying to track down what may have caused this.  The bizarre thing it the client IP address is the IP address of the SQL Server instance itself and there were no failed jobs at that time.  This is not normal behavior for this server and this is the first tie I have seen this and I am being asked by our security group what caused it.  Any help would greatly be appreciated

    Message
    SSPI handshake failed with error code 0x80090304 while establishing a connection with integrated security; the connection has been closed. [CLIENT: 172.16.20.139]

    Message
    Login failed for user ''. The user is not associated with a trusted SQL Server connection. [CLIENT: 172.16.20.139]

     

    Thursday, April 28, 2011 12:07 PM

Answers

  • If it is not occured permanetaly, do not worry about it, otherwise, she/he should check netweork card configuration, logs and etc.. why it has been disconected for this specific period of time


    Best Regards, Uri Dimant SQL Server MVP http://dimantdatabasesolutions.blogspot.com/ http://sqlblog.com/blogs/uri_dimant/
    Thursday, April 28, 2011 12:43 PM

All replies

  • Looks like networking problem...Can you ask NerworkAdmin?
    Best Regards, Uri Dimant SQL Server MVP http://dimantdatabasesolutions.blogspot.com/ http://sqlblog.com/blogs/uri_dimant/
    Thursday, April 28, 2011 12:11 PM
  • Sure, what kind of network problem should I be asking about?  We saw these on about 3-4 of our 300+ servers last night so it doesn't appear to be a full blown network issue
    Thursday, April 28, 2011 12:25 PM
  • If it is not occured permanetaly, do not worry about it, otherwise, she/he should check netweork card configuration, logs and etc.. why it has been disconected for this specific period of time


    Best Regards, Uri Dimant SQL Server MVP http://dimantdatabasesolutions.blogspot.com/ http://sqlblog.com/blogs/uri_dimant/
    Thursday, April 28, 2011 12:43 PM
  • If it is not occured permanetaly, do not worry about it, otherwise, she/he should check netweork card configuration, logs and etc.. why it has been disconected for this specific period of time


    Best Regards, Uri Dimant SQL Server MVP http://dimantdatabasesolutions.blogspot.com/ http://sqlblog.com/blogs/uri_dimant/
    Thursday, April 28, 2011 12:43 PM