event 17055 error code 18452 user (null) not associated with trusted account

Dear All,
I am new to this newsgroup so please forgive me if I am in the wrong
palce.
The subject line describes my problem in a nutshell.
I am getting and event id 17055 from one instance of our SQL Server
2000 DB on a windows 2003 server. There is a category (4) but, since I
am also new to Systems Admin, I don't know where to look for what this
means.
It occurs approximately every minute and is driving me mad!
The error text says code 18452 and mentions the user (null) is not
associated with a trsusted account.
Can anyone suggest where I might look for other clues to debug this?
I have looked on the web using Google but so far have not found
anything which obviously applies (and I have tried the not so obvious
too). Some people mention named pipes should be set for SQL Server 7
but we are running 2000. Also we have both windows and sql server
authentication set.
In any replies, I would be grateful if you would treat me like an idiot
(seriously) as I am very new to this stuff.
Many thanks to any experts who can guide me.
KevI hope I am reportiung the right thing here:-
Management Management Console version 2.0
Version 5.2 (Build 3790.svr03_sp1_qfe.050504-1733 : Service Pack 1)
Sql Server enterprise manager about box says version 8.00
"Theo Verweij" <tverweij@.xs4all.nl> wrote in message
news:uGaNcMAAHHA.3836@.TK2MSFTNGP02.phx.gbl...[vbcol=seagreen]
> What servicepack level do you have in your SQL?
> kevin-helena-dana@.ntlworld.com wrote:|||There are two ways to identify yourself to SQL Server. A SQL login requires
a user name and password. A Windows login will allow you to log in because
your windows user has permissions. When you install SQL Server you specify
whether it will accept Windows logins only or both Windows and SQL logins.
The error you are getting usually means that you installed SQL Server to
only accept Windows logins and now you are trying to log in as a SQL Server
user. It can also mean that the Windows user you are trying to login as
doesn't have permissions to log in to SQL Server. You can usually log in to
SQL Server if you are logged in to Windows on the server where SQL Server is
running as a Windows user who has administrator privileges on the Windows
box (it's possible to disable this but not very common).
This posting is provided "AS IS" with no warranties, and confers no rights.
Use of included script samples are subject to the terms specified at
http://www.microsoft.com/info/cpyright.htm
<kevin-helena-dana@.ntlworld.com> wrote in message
news:1162626998.434995.211460@.e3g2000cwe.googlegroups.com...
> Dear All,
> I am new to this newsgroup so please forgive me if I am in the wrong
> palce.
> The subject line describes my problem in a nutshell.
> I am getting and event id 17055 from one instance of our SQL Server
> 2000 DB on a windows 2003 server. There is a category (4) but, since I
> am also new to Systems Admin, I don't know where to look for what this
> means.
> It occurs approximately every minute and is driving me mad!
> The error text says code 18452 and mentions the user (null) is not
> associated with a trsusted account.
> Can anyone suggest where I might look for other clues to debug this?
> I have looked on the web using Google but so far have not found
> anything which obviously applies (and I have tried the not so obvious
> too). Some people mention named pipes should be set for SQL Server 7
> but we are running 2000. Also we have both windows and sql server
> authentication set.
> In any replies, I would be grateful if you would treat me like an idiot
> (seriously) as I am very new to this stuff.
> Many thanks to any experts who can guide me.
> Kev
>|||Thanks for that. You see I told you I was a bit slow - treat me like an
idiot.
The SQL Server is Developer edition version 8.00.2039 (SP4) so I guess that
this answers that question. I am not saying that Named Pipes is likely the
problem, just that others have said something about it. I really am stuck.
I am also grateful for the help offered.
Thanks again.
Kevin
"Theo Verweij" <tverweij@.xs4all.nl> wrote in message
news:uCDeMMCAHHA.4348@.TK2MSFTNGP04.phx.gbl...[vbcol=seagreen]
> No, you are reporting the version and servicepack of win2k3 (sp1).
> To check the version of SQL Server 2000:
> Go to the enterprise manager, rightclick the server and select properties.
> Here you can see the version and servicepack level of your SQL Server.
> The reason why I am asking this is, is that win2k3 only supports SP3 and
> higher. RTM, SP1 and SP2 are only accepting trusted connections on named
> pipes when they run on windows 2003.
>
> KEVIN GILES wrote:|||Thanks Roger.
I wonder if this is not the problem directly but a poart of it. The user is
reported as (null) which implies to me some kind of security ttranslation
from an actual user. Also, I wonder why this message would appear literally
every minute.
As an addendum, there is a message sent to system administrator saying 014 -
permission denied and then a similar "not associated" message. This arrives
at the same time as the event is logged.
I did also say that we have windows and Sql Server authority allowed - am I
missing the point?
Remember, treat me like an idiot and I will respond.
Thanks.
"Roger Wolter[MSFT]" <rwolter@.online.microsoft.com> wrote in message
news:%23iy3yHDAHHA.4808@.TK2MSFTNGP03.phx.gbl...
> There are two ways to identify yourself to SQL Server. A SQL login
> requires a user name and password. A Windows login will allow you to log
> in because your windows user has permissions. When you install SQL Server
> you specify whether it will accept Windows logins only or both Windows and
> SQL logins. The error you are getting usually means that you installed SQL
> Server to only accept Windows logins and now you are trying to log in as a
> SQL Server user. It can also mean that the Windows user you are trying to
> login as doesn't have permissions to log in to SQL Server. You can
> usually log in to SQL Server if you are logged in to Windows on the server
> where SQL Server is running as a Windows user who has administrator
> privileges on the Windows box (it's possible to disable this but not very
> common).
> --
> This posting is provided "AS IS" with no warranties, and confers no
> rights.
> Use of included script samples are subject to the terms specified at
> http://www.microsoft.com/info/cpyright.htm
> <kevin-helena-dana@.ntlworld.com> wrote in message
> news:1162626998.434995.211460@.e3g2000cwe.googlegroups.com...
>|||Aaah ... well actually I am not able to tell you this. I am the systems
admin (junior, learner) and the message has been appearing for some time but
no-one can identify when it started. The connectionstring is therefore not
available.
from anecdotal evidence the messages may have been appearing from about the
time we had a new Sharepoint Server added to our network which uses a DB on
this server. This is purely speculative and I have done some investigation
on this with no success.
The main problem I have is that I do not know WHERE to look to find out who
is really trying to connect and from which machine. The event logs were my
starting point.
Are there any tools or other places I can look at to help id this supposedly
(null) user and their origin? Then I may be able to cut them off.
Sorry to be a pain but I believe that mutual assistance and expert advice is
the purpose of such newsgroups as this.
Thanks for all help so far.
Kevin
"Theo Verweij" <tverweij@.xs4all.nl> wrote in message
news:unWu77LAHHA.3928@.TK2MSFTNGP03.phx.gbl...[vbcol=seagreen]
> Ok, it should work.
> Can you send us the connectionstring you are using?
> KEVIN GILES wrote:|||The application log should show what computer is attempting to connect to
the SQL Server.
Arnie Rowland, Ph.D.
Westwood Consulting, Inc
Most good judgment comes from experience.
Most experience comes from bad judgment.
- Anonymous
You can't help someone get up a hill without getting a little closer to the
top yourself.
- H. Norman Schwarzkopf
"KEVIN GILES" <giles.family@.ntlworld.com> wrote in message
news:MPk3h.1852$371.1771@.newsfe5-win.ntli.net...
> Aaah ... well actually I am not able to tell you this. I am the systems
> admin (junior, learner) and the message has been appearing for some time
> but no-one can identify when it started. The connectionstring is therefore
> not available.
> from anecdotal evidence the messages may have been appearing from about
> the time we had a new Sharepoint Server added to our network which uses a
> DB on this server. This is purely speculative and I have done some
> investigation on this with no success.
> The main problem I have is that I do not know WHERE to look to find out
> who is really trying to connect and from which machine. The event logs
> were my starting point.
> Are there any tools or other places I can look at to help id this
> supposedly (null) user and their origin? Then I may be able to cut them
> off.
> Sorry to be a pain but I believe that mutual assistance and expert advice
> is the purpose of such newsgroups as this.
> Thanks for all help so far.
> Kevin
> "Theo Verweij" <tverweij@.xs4all.nl> wrote in message
> news:unWu77LAHHA.3928@.TK2MSFTNGP03.phx.gbl...
>|||Aha .. thansk for your kind comments.
I have run a profiler trace and found out that one of our sharepoint servers
IS attempting to run some stored proc and I will do further investigation at
work tommorow.
I will let you knoe the resukts but that hint was a great help so far.
Kevin
"Theo Verweij" <tverweij@.xs4all.nl> wrote in message
news:eAU5dROAHHA.3536@.TK2MSFTNGP03.phx.gbl...[vbcol=seagreen]
> You are not a pain at all! - and an idiot would not ask these questions.
> What you can do is use the SQL Profiler to audit all logins, to see what
> connection is failing. Here you can see who is trying to connect to your
> server, causing this error.
>
>
> KEVIN GILES wrote:|||The null user generally means that the Windows user was not able to
authenticate to the server. The most common cause of this is the "double
hop" issue - login on to one Windows box and then using those credential to
log into SQL Server without delegation permissions. That doesn't sound like
the issue here though. It more likely that the Windows user you are running
as doesn't have permissions on the server where SQL is running.
This posting is provided "AS IS" with no warranties, and confers no rights.
Use of included script samples are subject to the terms specified at
http://www.microsoft.com/info/cpyright.htm
"KEVIN GILES" <giles.family@.ntlworld.com> wrote in message
news:mU73h.982$GX2.275@.newsfe7-gui.ntli.net...
> Thanks Roger.
> I wonder if this is not the problem directly but a poart of it. The user
> is reported as (null) which implies to me some kind of security
> ttranslation from an actual user. Also, I wonder why this message would
> appear literally every minute.
> As an addendum, there is a message sent to system administrator saying
> 014 - permission denied and then a similar "not associated" message. This
> arrives at the same time as the event is logged.
> I did also say that we have windows and Sql Server authority allowed - am
> I missing the point?
> Remember, treat me like an idiot and I will respond.
> Thanks.
> "Roger Wolter[MSFT]" <rwolter@.online.microsoft.com> wrote in message
> news:%23iy3yHDAHHA.4808@.TK2MSFTNGP03.phx.gbl...
>|||Thanks for the help so far, everyone. This weekend we are likely to have a
shut down of our server network and I am going to check after each other
server is shutdown to see which of them has been trying to make contact.
I have looked in the app event log but there is no apparent info unless I am
missing something.
I will let you know how I get on after the weekend.
Kevin
"Arnie Rowland" <arnie@.1568.com> wrote in message
news:eaApjOPAHHA.3396@.TK2MSFTNGP02.phx.gbl...
> The application log should show what computer is attempting to connect to
> the SQL Server.
> --
> Arnie Rowland, Ph.D.
> Westwood Consulting, Inc
> Most good judgment comes from experience.
> Most experience comes from bad judgment.
> - Anonymous
> You can't help someone get up a hill without getting a little closer to
> the top yourself.
> - H. Norman Schwarzkopf
>
> "KEVIN GILES" <giles.family@.ntlworld.com> wrote in message
> news:MPk3h.1852$371.1771@.newsfe5-win.ntli.net...
>