I have dozens of SQL Servers, on many different versions. Many of them have an error in the SQL Server error log EVERY DAY at just about 2 am.
Login failed for user 'TheDomain\SQLServerAgentServiceAccount'
Some show this reason:
Reason: Token-based server access validation failed with an infrastructure error. Check for previous errors. [CLIENT: <local machine>] Error: 18456, Severity: 14, State: 11.
The rest show this:
Reason: Could not find a login matching the name provided. [CLIENT: <local machine>] Error: 18456, Severity: 14, State: 5.
Our network team doesn't see anything suspicious in this time frame. The second reason makes sense and is true - there ISN'T a matching login for the service account. I don't know why there would be an explicit one created for a service account.
What could the servers be trying to do at the same time every day? There are no Agent jobs, backups, maintenance plans, or any other known services that would do anything.