Home/ Questions/Q 522277
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-13T08:20:14+00:00

I’m looking at my event viewer on my computer and seeing that every single

  • 0

I’m looking at my event viewer on my computer and seeing that every single event in the Applicaiton event viewer is a Failure Audit for SQL Server. The properties of the event all say

Login failed for user ‘sa’. Reason:
Password did not match that for the
login provided. [CLIENT:
78.111.98.132]

Does this mean that there is somebody trying to crack my password? IS there anyway to stop this? Also there don’t seem to be any other events beside this one, is there a reason for that?

This is a Windows Server 2003 R2 Enterprise edition, w/ Service Pack 2
running SQL Server Standard 2008

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    The IP you gave traces to a Turkish ISP in Istanbul, and I suspect that is not where you expecting login attempts, certainly not to SA.

    Unless you absolutely need it, disable the SA account, ban the IP range and then get more info on server hardening.

    • 0