none
Tabular Profiler Trace can't locate error source: The following system error occurred: The user name or password is incorrect. RRS feed

  • Question

  • Hello,

    I am receiving this error every 20 ish minutes or so.

    I cannot seem to determine WHERE this error is coming from.  What process is attempting this failed login.

    In the trace I get:

    "The following system error occurred:  The user name or password is incorrect. " with username of the SSAS Service account.

    It corresponds to an event log entry in the security log of: Event ID 4625 login failure.

    The account shown under the Security ID is my SSAS service account.

    I'm totally at a loss as to determine where this failed login is coming from?

    On the domain event log side of things I can see that a A Kerberos authentication ticket (TGT) was requested.

    Then is lists an account that belongs to ourdomain.onmicrosoft.com with a user ID of NUILL SID.

    Below is the event log from the SSAS server:

    -----

    System
    - Provider
    [
    Name]
    Microsoft-Windows-Security-Auditing
    [
    Guid]
    {54849625-5478-4994-A5BA-3E3B0328C30D}
    EventID 4625
    Version 0
    Level 0
    Task 12544
    Opcode 0
    Keywords 0x8010000000000000
    - TimeCreated
    [
    SystemTime]
    2018-11-29T15:45:08.113110000Z
    EventRecordID 70106412
    Correlation
    - Execution
    [
    ProcessID]
    732
    [
    ThreadID]
    7608
    Channel Security
    Computer SSAS-SERVER-NAME.domainname.com
    Security
    - EventData
    SubjectUserSid S-1-5-21-3937660100-2620109559-2965839201-25021
    SubjectUserName SSAS_SERVICE_ACCOUNT_NAME
    SubjectDomainName domainname.com
    SubjectLogonId 0x24155
    TargetUserSid S-1-0-0
    TargetUserName
    TargetDomainName
    Status 0xc000006d
    FailureReason %%2313
    SubStatus 0xc0000064
    LogonType 3
    LogonProcessName OLAPSvc
    AuthenticationPackageName Kerberos
    WorkstationName SSAS-SERVER-NAME
    TransmittedServices -
    LmPackageName -
    KeyLength 0
    ProcessId 0x920
    ProcessName C:\Program
    Files\Microsoft SQL
    Server\MSAS13.TAB01\OLAP\bin\msmdsrv.exe
    IpAddress -
    IpPort -

    -----------------------------------------

    Thursday, November 29, 2018 4:12 PM

All replies

  • Hi OneWithQuestions,

    You may need to use Network Monition tool or SQL Server Profiler to catch the connection information of source, e.g. hostname, ip address.

    Besides, please check this open source tool to monitor activity of SSAS instance.

    https://www.sqlbi.com/tools/ssas-activity-monitor/

    Check if this helps.

    Regards,

    Pirlo Zhang 


    MSDN Community Support<br/> Please remember to click "Mark as Answer" the responses that resolved your issue, and to click "Unmark as Answer" if not. This can be beneficial to other community members reading this thread. If you have any compliments or complaints to MSDN Support, feel free to contact <a href="mailto:MSDNFSF@microsoft.com">MSDNFSF@microsoft.com</a>.

    Friday, November 30, 2018 6:09 AM