Join Log in
Score:1
Krackout avatar Server

MS SQL server 2019 failover cluster - Event ID 18456, Login failed for user 'domain\server1$'

it flag
Krackout

New MS SQL server 2019 installation on Windows Server 2019, failover cluster role enabled; fully patched Windows, SQL 2019 CU 11.

Nodes:
server1 - 10.10.10.1
server2 - 10.10.10.2

Instances:
sql1
sql2

The instances were initially installed: sql1 on server1, sql2 on server2, clustered install. sql1 and sql2 do failover smoothly, everything works as expected.

The problem is a seemingly harmful event on Windows Logs -> Application (Event ID 18456):

Login failed for user 'domain\server1$'. Reason: Could not find a login matching the name provided. [CLIENT: 10.10.10.1]

and

Login failed for user domain\server2$. Reason: Could not find a login matching the name provided. [CLIENT: 10.10.10.2]

The events are produced when sql1 is moved to server2 and sql2 is moved to server1. It seems that there is some kind of record on each instance with the server that was installed initially and is searching for it. No issues apart from the annoying message.

I've searched the Net a lot, tried the suggestions about disabling CEIP telemetry, disabled sql services one by one to locate the one producing the event (sql server produces it), added the NT AUTHORITY\NETWORK SERVICE to logins, sysadmin on both sql1 & sql2. No effect. Any ideas?

It seems that domain\server1$ is a service account - virtual account. In the initial sql instances installation some services where started by non-domain accounts (default suggestion). But now all services start using domain accounts, yet the event is still produced.

126
0 + 0
cn flag
Greg Askew
`It seems that domain\server1$ is a service account`. It's the computer account. In AD the computer account samAccountName is suffixed with $.
0
Reply
Krackout avatar
it flag
Krackout
@GregAskew, it is, but I cannot locate any record of it, where it's used. I just get the event.
0
Reply
cn flag
Greg Askew
Nearly all Windows hosts use their AD machine account for authentication. May be a transient recoverable condition created by the failover.
0
Reply
ธงชาติไทย
Elon Musk
I sit in a Tesla and translated this thread with Ai:

mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.