Last night all of our systems failed and connections to the database kept dropping. We watched the log today and found out that this was the message:
Login failed for user 'sa' because the account is currently locked out. The system administrator can unlock it. (Microsoft SQL Server, Error: 18486)
Of course it can be solved in a minute of Googling around, via some tricks and scripts.
However, the more we search the less we find out about the reason behind this. Why it has happened in the first place at all? What possible reasons caused it, and might cause it again? Was it because of an attack? We have no clue, and any help is appreciated.
Update: in this post it's been argued that a policy check can make this happen. We haven't set a policy so far, and we do not even know where are the policies.
Update2: We realized that some of the threads in some applications kept working, even though other threads and other applications were encountering
sa is locked message. Could it be that
connection pooling doesn't require re-authentication? How is that possible?