Login failed. The login is from an untrusted domain and cannot be used with Windows authentication

Question

I am using Sp2013 Standard server, with 1 APP, 1 WFE, 1 Workflow and 1 Clustered SQL. Everything was all great until Monday Morning (7-28-14). Thats when Event Log started to fire off following messages:

Log Name: Application

Source: Microsoft-SharePoint Products-SharePoint Foundation

Date: 7/28/2014 1:30:12 PM

Event ID: 5586

Task Category: Database

Level: Error

Keywords:

User: Domain\svc_sp13_frm

Computer: computer name

Description:Unknown SQL Exception 18452 occurred. Additional error information from SQL Server is included below.

Login failed. The login is from an untrusted domain and cannot be used with Windows authentication.

Event Xml:

<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-SharePoint Products-SharePoint Foundation" Guid="{6FB7E0CD-52E7-47DD-997A-241563931FC2}" />
    <EventID>5586</EventID>
    <Version>15</Version>
    <Level>2</Level>
    <Task>3</Task>
    <Opcode>0</Opcode>
    <Keywords>0x4000000000000000</Keywords>
    <TimeCreated SystemTime="2014-07-28T17:30:12.720675600Z" />
    <EventRecordID>131333</EventRecordID>
    <Correlation ActivityID="{2903A99C-2EB3-A0BB-0CA0-6C38BB29484F}" />
    <Execution ProcessID="15220" ThreadID="8740" />
    <Channel>Application</Channel>
    <Computer>computer Name</Computer>
    <Security UserID="S-1-5-21-2000478354-2111687655-839522115-201619" />
  </System>
  <EventData>
    <Data Name="int0">18452</Data>
    <Data Name="string1">Login failed. The login is from an untrusted domain and cannot be used with Windows authentication.</Data>
  </EventData>
</Event>

I checked SQl Log at the Same time this is what i found:

07/28/2014 13:30:12,Logon,Unknown,Login failed. The login is from an untrusted domain and cannot be used with Windows authentication. [CLIENT: ] 07/28/2014 13:30:12,Logon,Unknown,Error: 18452 Severity: 14 State: 1. 07/28/2014 13:30:12,Logon,Unknown,SSPI handshake failed with error code 0x80090311 state 14 while establishing a connection with integrated security; the connection has been closed. Reason: AcceptSecurityContext failed. The Windows error code indicates the cause of failure. No authority could be contacted for authentication. [CLIENT: ] 07/28/2014 13:30:12,Logon,Unknown,Error: 17806 Severity: 20 State: 14.

All of my Sites and Services are working as expected, but i am confused why did sharepoint started to fire off such errors.

Servers havent been rebooted or has been made any changes recently for both Sharepoint and SQl.

Thank You

Answer 1

Coming back late to this but if you are still up an running is it because your services are load balanced across your two servers? The errors should tell you which machine is generating the logon attempt. It could be one of the following:

1. Time is off - Kerberos by default requires all servers be within 5 minutes of each other, if the Auth token time stamp is not correct you will get the message.

2. One of your servers has lost it's trust with your domain, and needs to be removed - and rejoined back to the domain.

3. Network issues that cause delays or interrupts the communication form any server to the domain could cause these errors. Actually just having a busy DC could do this if it's not sized according to traffic.

4. The logon attempt is coming from a scheduled job or service running on another machine.

Answer 2

Check whether any job is using the farm account and trying to connect to the database from SharePoint server. First, try to stop 'SharePoint timer service' for some time and check whether you are still getting the error logs. If it is stopped, there must be some job which is trying to connect to the database. You can get default list of services for SharePoint here.

Most of the cases, database Performance metric provider, Health Analysis (Hourly, Microsoft SharePoint Foundation Timer, any server) jobs will try to connect to the database. If no dependencies are there on these jobs you can stop it.