I have two Microsoft SQL servers, one running 2008 R2 Enterprise, one running 2012 Enterprise. Both are logging lots of failed connections requests due to untrusted domain :
SSPI handshake failed with error code 0x8009030c, state 14 while establishing a connection with integrated security; the connection has been closed. Reason: AcceptSecurityContext failed. The Windows error code indicates the cause of failure. The logon attempt failed [CLIENT: 10.180.42.1]
Error: 18452, Severity: 14, State: 1.
Login failed. The login is from an untrusted domain and cannot be used with Windows authentication. [CLIENT: 10.180.42.1]
There's nothing in the Windows Security event logs, and only the SQL errors are in the Application event log and they are the same as the one in the SQL error logs.
The most likely culprit is an internal process trying to connect using Windows authentication, but with a local machine account, but how do I prove it?
I've tried running Profiler capturing audit events, but it doesn't have any more information than the error logs.
How can I find out what credentials the failed login attempt is using and what server the connection request is coming from?