Domain user no longer exists but getting errors in application log

Question

Hi,
We had a domin user with which SQL service and SQL agent is configured to start. But this account does not have access to that server in which SQL is installed now. I can see the follwing message in application log:
Log Name:      Application
Source:        MSSQLSERVER
Date:          3/10/2014 2:00:00 PM
Event ID:      18456
Task Category: Logon
Level:         Information
Keywords:      Classic,Audit Failure
User:          Domain \username
Computer:      XXXX
Description:
Login failed for user 'Domain \username'. Reason: Failed to open the explicitly specified database. [CLIENT: <local machine>]
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="MSSQLSERVER" />
    <EventID Qualifiers="49152">18456</EventID>
    <Level>0</Level>
    <Task>4</Task>
    <Keywords>0x90000000000000</Keywords>
    <TimeCreated SystemTime="2014-10-03T04:00:00.000000000Z" />
    <EventRecordID>20420597</EventRecordID>
    <Channel>Application</Channel>
    <Computer>XXXXXXX</Computer>
    <Security UserID="S-1-5-21-2091904384-3689332406-323980668-6522" />
  </System>
  <EventData>
    <Data>domain\usernamer</Data>
    <Data> Reason: Failed to open the explicitly specified database.</Data>
    <Data> [CLIENT: &lt;local machine&gt;]</Data>
    <Binary>184800000E000000100000004100550030003400550041005000300036003800510041004E00380032000000070000006D00610073007400650072000000</Binary>
  </EventData>
</Event>
How come this message is coming in the application log, since no one has tried to log in to the application?

Answer 1

Hi Both are 2008R2 version. My doubt is I can see that login failed message in application log but how to find out which process is trying to use that login?
First observe that this is something that runs on the same machine as SQL Server. (The error message says "CLIENT: <local machine>".) That may be a clue enough.
If not, set up a includes Audit: Login Failed and no other event. Of interest are the columns ApplicationNmae and the the column ClientProcessID. ApplicationName may be sufficient, but if not you can use ClientProcessID and match this against the PIDs you
see in Task Manager or Process Explorer. There is a risk it is a short-lived process and then you will have to look at Process Explorer and Profiler in parallel.
Erland Sommarskog, SQL Server MVP, [email protected]