SQL Express 2005 - event log errors

[penguinroundup]

I have a print server running SQL2005 Express, and I'm getting the following errors in my event log and my print spooler locks up (I have to restart the spooler service to get things moving again):

Event Type: Failure Audit
Event Source: MSSQL$SQLEXPRESS
Event Category: (4)
Event ID: 18452
Date: 3/12/2007
Time: 11:31:59 AM
User: N/A
Computer: MYPRINTSERVER
Description:
Login failed for user ''. The user is not associated with a trusted SQL Server connection. [CLIENT: <local machine>]


I've changed the database authentication to Mixed Mode, per MicroSoft's kb article about this event ID, but I'm still having the same problems. I've goodled this eventID to death, I think, but found nothing really helpful.

any ideas or suggestions out there?

 

[SQLBill]

Do you have any failed login messages in the Windows Event Viewer Security logs?

Do you have Enterprise Manager installed?
If so, right click on the instance, select Properties, go to the Security tab, make sure you are auditing failed logins, then check the SQL Server Agent Error Log for failed logins.

Something is trying to log into your SQL Server and is not trusted. That means it most likely does not have a SQL Server account using Windows Authentication.

-SQLBill

Posting advice: FAQ481-4875

 

[mrdenny]

Sounds like something is trying to log in with a SQL Account and the SQL Express is setup to only use Windows Auth.

Denny
MCSA (2003) / MCDBA (SQL 2000)
MCTS (SQL 2005 / Microsoft Windows SharePoint Services 3.0: Configuration / Microsoft Office SharePoint Server 2007: Configuration)
MCITP Database Administrator (SQL 2005) / Database Developer (SQL 2005)

--Anything is possible. All it takes is a little research. (Me)

http://www.mrdenny.com

 

[penguinroundup]

I did notice that my 'sa' account has been disabled, I'm assuming for security purposes. Could that have anything to do with it? My authentication is set to "SQL and Windows authentication". I do have the failure auditing enabled, that's why I'm getting these failure events at all, I presume.

It would be helpful if the event log didn't say "login failed for '<null>'" - ANY information would be helpful here!! LOL

we do have another domain that (I think) trusts us, but we don't trust them, if they're printing to our print server, could that have anything to do with why it's not picking up the username??

grrrr. I love Microsoft products!

 

[SQLBill]

I don't know of anyway to disable the sa account. It is built into SQL Server. I do know that if you change the authentication to Windows Only, the sa account will no longer work.

Log in, open Enterprise Manager, right click on the instance, select properties and see if it is set for Windows Authentication only.

-SQLBill

Posting advice: FAQ481-4875

 

[penguinroundup]

As I stated in my first post, I have already changed the authentication type to "SQL and Windows Authentication".

the login failures I'm getting in my event log are for user '<null>' - so it doesn't tell me whose login is failing.

If I go into Security -> Logins and view the status of the 'sa' account, it has a little red down arrow on it, and login is set to "disabled" (remember, I've got SQL Express 2005, NOT 2000).

 

[mrdenny]

Have you restarted the SQL Services since you changed it to SQL and Windows Auth?

Try enabling the sa account. The sa account shouldn't be disabled. If it's not being used it should have a strong password set, but it should be left enabled.

What happens in the machine falls off the domain for some reason. Without the sa account you would have no way into the SQL Server.

Denny
MCSA (2003) / MCDBA (SQL 2000)
MCTS (SQL 2005 / Microsoft Windows SharePoint Services 3.0: Configuration / Microsoft Office SharePoint Server 2007: Configuration)
MCITP Database Administrator (SQL 2005) / Database Developer (SQL 2005)

--Anything is possible. All it takes is a little research. (Me)

http://www.mrdenny.com