Login failed for user 'NT AUTHORITY\SYSTEM'. Reason: Failed to open the explicitly specified database 'dbName'. [CLIENT: <local machine>]

Question

I'm getting this error every night at 8:33PM. The NT AUTHORITY\SYSTEM is also added to the SQL Server Security/Login with Sysadmin permission.

Login failed for user 'NT AUTHORITY\SYSTEM'. Reason: Failed to open the explicitly specified database 'dbName'. [CLIENT: <local machine>]

This error shows up in the default SQL Server instance; however, the dbName database is in the sqlServer/2ndInstance. So this also puzzles me why NT AUTHORITY\SYSTEM failed login shows up trying to login into a second instance from the default instance.

Answer 1

Here's what the audit shows but I don't think there is any useful information here.

Date 2/4/2021 2:34:01 AM
Log Audit Collection (LoginFailed)

Event Time 02:34:01.6182729
Server Instance Name DevDB
Action ID LOGIN FAILED
Class Type LOGIN
Sequence Number 1
Succeeded False
Permission Bit Mask 0x00000000000000000000000000000000
Column Permission False
Session ID 0
Server Principal ID 0
Database Principal ID 0
Target Server Principal ID 0
Target Database Principal ID 0
Object ID 0
Session Server Principal Name
Server Principal Name NT AUTHORITY\SYSTEM
Server Principal SID NULL
Database Principal Name
Target Server Principal Name
Target Server Principal SID NULL
Target Database Principal Name
Database Name
Schema Name
Object Name
Statement Login failed for user 'NT AUTHORITY\SYSTEM'. Reason: Failed to open the explicitly specified database 'dbName'. [CLIENT: <local machine>]
Additional Information <action_info xmlns="http://schemas.microsoft.com/sqlserver/2008/sqlaudit_data"><pooled_connection>0</pooled_connection><error>0x00004818</error><state>38</state><address>local machine</address></action_info>
File Name C:\Temp\SQLAuditFiles\LoginFailed_C9114B7D-590B-48B9-8978-D40508F15326_0_132568475672460000.sqlaudit
File Offset 10240
User Defined Event ID 0
User Defined Information
Sequence Group ID 0x1D52222EBA21AE4E884DD7A55652AC6C
Transaction ID 0
Client IP local machine
Application Name SMS_MP_FILE_DISPATCH_MANAGER
Affected Rows 0
Response Rows 0
Connection Id 1429ba8e-ca3c-4391-b7e8-0792f5a655c7
Duration Milliseconds 0
Data Sensitivity Information

Message

Answer 2

Here's what the audit shows but I don't think there is any useful information here.

Nah, there is one titbit:

Application Name SMS_MP_FILE_DISPATCH_MANAGER

I've never heard of SMS_MP_FILE_DISPATCH_MANAGER before, but a quick googling indicates that this is part of SCCM. Could that be a clue?

Answer 3

Hi CharlieLor-4693,

It seems the SMS_MP_FILE_DISPATCH_MANAGER which is the component of SCCM was trying to connect to the databases and failed to login. Could you please check mpfdm.log which is on the Configuration Manager site server and site system servers. Please refer to Server log files which might help.
In addition, I’m not familiar with SCCM. You can add a tag mem-cm-general or open a thread in the mem-cm-general so that people there will help you more effectively.

Best Regards,
Amelia

Answer 4

There is no error in the mpfdm.log file. There is no mentioned of NT AUTHORITY\SYSTEM. I'm not sure what else to look for.