Failure Audit in Event Viewer for MOSS user

When you delete a Shared Service Provider in the Sharepoint Central Administration there can still be a SQL Server job associated, and this can result in a very annoying situation that is to have every minute a Failure Audit error in the Event Viewer.

Error in Event Viewer:

Event Type: Failure Audit
Event Category: (4)
Event ID: 18456
Date:  06-06-2008
Time:  16:36:00
User:  domain\username
Computer: computername
Login failed for user ‘domain\username’. [CLIENT: <local machine>]

For more information, see Help and Support Center at
0000: 18 48 00 00 0e 00 00 00   .H……
0008: 0a 00 00 00 53 00 52 00   ….S.R.
0010: 56 00 41 00 50 00 41 00   V.A.P.A.
0018: 53 00 51 00 4c 00 00 00   S.Q.L…
0020: 07 00 00 00 6d 00 61 00   ….m.a.
0028: 73 00 74 00 65 00 72 00   s.t.e.r.
0030: 00 00                     ..

To solve this you just have to go to the SQL Server Management Studio, on the SQL Server Agent choose Job Activity Monitor and you will have the information of all jobs running and failing, if you Disable the failing job associated to the SSP that will end the Failure Audit messages from showing in the Event Viewer.

Computer developer/consultant from Portugal. You can find me at

Posted in Other, Sharepoint
2 comments on “Failure Audit in Event Viewer for MOSS user
  1. minhasquier says:

    Hi Ricardo,

    I have this same problem using MOSS 2007, I recieve the error Login failed for user ‘domain\MOSS_Serv’.

    I tried to open job activity monitor to search failing jobs, but I haven’t found any…. Should there be another reason for this?

    Muito obrigado.

  2. Lars Bo Wassini says:

    I have the same problem as Muito: It’s my MOSS server that keeps showing up in the log and there’s nothing in the monitor.

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

%d bloggers like this: