Event ID 18456: user & lt; domain \ computer name & gt; Logon Failed. Cause: Token-based server access Verification Failed, with a infrastructure error, 18456 token

Event ID 18456: User <domain \ computer name> Logon Failed. Cause: Token-based server access Verification Failed, with a infrastructure error, 18456 token

Event Type: Audit Failed

Event Source: MSSQLSERVER
Event Type: Logon
Event ID: 18456
Date:
Event: 11:11:21
User: domain \ computer name
COMPUTER: domain
Description:
User 'domain \ computer name $ 'Login Failed. Cause: the token-based server access verification fails and an infrastructure error occurs. Check for previous errors. [Client: 192.168.1.183]


For more information, see Help and Support Center in http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 18 48 00 00 0e 00 00 .......
0008: 0c 00 00 00 53 00 5a 00 ....
0010: 31 00 43 00 41 00 52 00
0018: 44 00 31 00 2d 00 44 00
0020: 42 00 00 00 07 00 00 00 B ......
0028: 6d 00 61 00 73 00 74 00
0030: 65 00 72 00 00 00 e. r...

Analysis and Solution:

Now we only know this computer: [domain \ computer name], IP: 192.168.1.183, this computer to connect to the current database server, only prompt "Audit Failed"

But it is unclear what processes or services are connected! So there is nothing to analyze this error !~

Open [SQL Server Profiler] To monitor the following events. Be sure to select the column 【ClientProcessID]:

Error and Warnings \ ErrorLog

Error and Warnings \ ErrorLog

Start tracking for a period of time until this error occurs !~

Here is the process number ClientProcessID = 2136

Log on to the server 192.168.1.183, Open Task Manager, and find the service whose process number is ClientProcessID = 2136.

Open the computer service and find that the service is run on a "local system". It is changed to a domain administrator or another account!

In this case, the account permissions are mostly insufficient.