Mysterious login error message

I get the following error messages in the sql server error log

Source Logon

Message
Error: 18456, Severity: 14, State: 11.

and

Source Logon

Message
Login failed for user 'NT AUTHORITY\ANONYMOUS LOGON'. [CLIENT: 185.23.11.33]

The scenario is: We set up log-shipping (LS) between a clustered sql server system (source server) and a stand-alone sql server box (target server). (SQL Server 2K5 EE + SP1), and LS goes very well, but on the target server, we found the above-mentioned error messages.
BTW: the two servers are in the same domain.

Did I miss something in configuration?

Thanks in advance for your help..

Jeff

It looks like a delegation problem. Most likely the credentials from a 3rd machine (most likely the client) are used to connect to the source SQL Server are being used to connect to the target SQL Server. If this is the case, the following articles will hopefully help you to fix it:

Security Account Delegation http://msdn.microsoft.com/library/default.asp?url=/library/en-us/adminsql/ad_security_2gmm.asp

Specifying Credential and Connection Information http://msdn2.microsoft.com/en-us/library/ms160330.aspx

Let us know if this information helped.

-Raul Garcia

SDE/T

SQL Server Engine

|||

Hi Raul,

I do not think we have a 3rd machine/application to connect to the source server / or the target server. Actually, we setup both source server and target server (in our log-shipping scenario) to use the same domain account as SQL Server service and sql server agent service startup account.

For the 1st reference link you mentioned, i.e. Security Account Delegation http://msdn.microsoft.com/library/default.asp?url=/library/en-us/adminsql/ad_security_2gmm.asp our environment is Win 2K3 EE + SP1 (64 bit) and SQL Server 2K5 EE + SP1 (64bit), so it seems unapplicable here.

Personally I believe it is has something to do with the log-shipping, because we setup log shipping cycle at 10 minutes (from 12:00:00 am to 11:59:00pm), and I can see every 10 minutes, for example at 12:10:00am, the login failure errors occur in the target server's sql server error log, and then not appear until 12:20:00am.

Do you have some other thoughts regarding this?

Thanks a lot for your help, which is greatly appreciated...

BTW, in the error message

Message
Login failed for user 'NT AUTHORITY\ANONYMOUS LOGON'. [CLIENT: 185.23.11.33]
Here [CLIENT: 185.23.11.33] is the ip address of our source server (node 1 in two clustered server environment)

|||

Unfortunately I cannot think of any other reason why you would get this particular error message; hopefully somebody else may have a better answer. Another option could be to post your question on the SQL Server Database Engine forum (http://forums.microsoft.com/MSDN/ShowForum.aspx?ForumID=93&SiteID=1), hopefully there we may find somebody with more knowledge on log-shipping who may be able to answer your question.

-Raul Garcia

SDE/T

SQL Server Engine

|||With the help from MVP oj, I finally figured it out. The error appeared because a linked server (on the source) was created by the Log-shipping wizard ( but I still do not understand why Log-shipping needs a linked server), and after configured the linked server by giving a remote user with password, the error disappears.