Hello, I have been fighting this error on my WFE/APP Server for the last two weeks and I have followed the guidance from Microsoft but the fix did nothelp; the error is still there. I have also researched a fix on the Internet but could not find anything other than the Microsoft fix.Every morning between 12:45AM and 1:25AM I receive 11 of event ID 3351 errors on my WFE/App server. While onmy DB server I receive five Error 18456. Everymorning same time 7 days a week. Any suggestions on how to fix the error? We have made no know changes to the MOSS configuration. Event Type:ErrorEvent Source:Windows SharePoint Services 3Event Category:Database Event ID:3351Date:3/6/2008Time:12:45:30 AMUser:N/AComputer:SERVERDescription:SQL database login failed. Additional error information from SQL Server is included below. Login failed for user 'NT AUTHORITY\ANONYMOUS LOGON'. For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp. In the SQL Server Logs I receive Login failed for user 'NT AUTHORITY\ANONYMOUS LOGON'. [CLIENT: IP ADDRESS] Error: 18456, Severity: 14, State: 11 Thanks, Scott

Sounds to me like you've got a farm backup scheduled at that time which is failing due to bad credentials. This should be listed in your scheduled jobs in central admin. It's possible your timer service is running under bad credentials.

I am currently trying to resolve the same problem at two different sites.One with SP1 and the other without.Everything is working fine, even backups but the following error keeps popping up in the event log:Event Type: ErrorEvent Source: Windows SharePoint Services 3Event Category: DatabaseEvent ID:3351Date: 2008/03/15Time: 10:04:17 PMUser: N/AComputer: <Server Name> Description: SQL database login failed. Additional error information from SQL Server is included below. Login failed for user 'NT AUTHORITY\ANONYMOUS LOGON'.For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.I followed the advice of MS (http://technet2.microsoft.com/windowsserver/WSS/en/library/bbec1006-1198-4c2e-a2d0-ffdb53aca1281033.mspx?mfr=true ) with no change.There are no scheduled backups but still the error pops up at odd hours.Sometimes 20h00 or 21h00 or 22h00 or even 05h00.The only other time it pops up is when a basic config change to SharePoint is made (like deleting a web application) or a backup is made. Here are some lines from SharePoint's trace log: w3wp.exe (0x17DC) 0x06E0 1624 8acf Verbose Current user after SqlConnection.Open: Name: <domain>\farmservice SID: S-1-5-21-727545429-4287480209-1687631883-3009 ImpersonationLevel: None w3wp.exe (0x17DC) 0x06E0 Windows SharePoint Services Database 880m Verbose SqlCommand: 'dbo.proc_getObjectsByBaseClass' CommandType: StoredProcedure CommandTimeout: 0 Parameter: '@RETURN_VALUE' Type: Int Size: 0 Direction: ReturnValue Value: '' Parameter: '@BaseClassId' Type: UniqueIdentifier Size: 0 Direction: Input Value: '9920f486-2ff4-4d10-9532-e01979826585' Parameter: '@ParentId' Type: UniqueIdentifier Size: 0 Direction: Input Value: '37e99899-4a98-47fd-a4b4-7f7578baf71c' SPWRITER.EXE (0x0860) 0x163C Windows SharePoint Services Database 880i High System.Data.SqlClient.SqlException: Login failed for user 'NT AUTHORITY\ANONYMOUS LOGON'. at System.Data.SqlClient.SqlInternalConnection.OnError(SqlException exception, Boolean breakConnection) at System.Data.SqlClient.TdsParser.ThrowExceptionAndWarning(TdsParserStateObject stateObj) at System.Data.SqlClient.TdsParser.Run(RunBehavior runBehavior, SqlCommand cmdHandler, SqlDataReader dataStream, BulkCopySimpleResultSet bulkCopyHandler, TdsParserStateObject stateObj) at System.Data.SqlClient.SqlInternalConnectionTds.CompleteLogin(Boolean enlistOK) at System.Data.SqlClient.SqlInternalConnectionTds.AttemptOneLogin(ServerInfo serverInfo, String newPassword, Boolean ignoreSniOpenTimeout, Int64 timerExpire, SqlConnection owningObject) at System.Data.SqlClient.SqlInternalCo... Any help would be greatly appreciated.RoviWil

Have you made any further progress on this? I'm also getting the exact same problem with my recent WSS installation (using the integrated SP1 media). Basically, whenever I make a change via Central Admin or when a timer job runs, the error pops up. But, as you say, everything appears to be working fine.I found several other people reporting the same problem on other forums, but so far no-one has posted any resolution. Interestingly my MOSS installation, which uses the same db server, is not reporting this error. Cheers, Skotlanti

Still receiving the errors but less frequently, but still have not found the underlying problem.

AFRetired07 wrote: Still receiving the errors but less frequently, but still have not found the underlying problem. Same here. I now get the errors every evening before 9.I've checked and there is nothing running at that time (backups, scheduled jobs). Can anyone out there in SharePoint land take a stab at this and give us a solution or point us into the right direction?

I fixed my error... On the server in my FARM that was generating the error the Windows SharePoint Services Timer was configured to run with "local system account" instead of the sharepoint account we created for installation. Once I changed this I stopped having the error. I don't know how one server was correct and the other not but now I stopped receiving the error. Scott

I checked that as well but no cigar.I had a suspicion that this is a configuration problem but all the things I have checked seem to be in order.At this moment all I am looking for is to get some idea on how to easily pinpoint the probable causes of this annoying error.I cant see anything thats broken because of this error.RoviWil

If any of you have Portal Shield installed on your servers check outhttp://www.sharepointblogs.com/bobbyhabib/default.aspxthere can be an issue with that apps configuration that causes these errors every 5 minutes.

Here was my situation and what ended up fixing it for my environment. I cannot guarantee that this will solve the issue in your environment, but this worked for me.Our Scenario: This event 3351 started showing up after we upgraded our WSS 3.0 server to MOSS 2007 Enterprize and added 2 new Servers to the Farm. From that time onward whenever trying to perform various Central Admin Tasks such as specifying the WSS Help Search credentials or creating a new content database, (which both would complete successfully), but the Application Log was populated with numerous Event ID 3351 Errors at the time of performing the Central Admin tasks.To keep this brief here is what fixed it for my SharePoint environment:Step 1. As always, try this out in a test environment first, then schedule a planned down time because IIS will need to be restarted several times, and after the final step the servers will need to be rebooted.Step 2. Follow all instructions in KB934838,http://support.microsoft.com/kb/934838/en-us. Complete all of these commands as they pertain to your environment. ex. If your environment does not have Single Sign On, configured then you can ignore that step. Step 3. After performing all of those STSADM commands, and the Central Admin Steps,on all the servers specified and completing all of the IISRESET /Noforce commands that accompany them, thenfrom a command line run psconfig.exe -cmd secureresourcesRun it first on the Server that hosts your Central Admin Site, then perform that command on every server in your farm. (It isn't required, but it is helpful to pipe the results to a text file.) Also for reference, I'll include theTechNet article about PSCONFIG,http://technet.microsoft.com/en-us/library/cc263093.aspxStep 4. Again starting with the server that hosts your Central Admin Site, reboot the server. Then reboot the rest of the servers in your farm one at a time. (Apparently, some of the registry settings made by PSCONFIG.exe Secureresources do not take effect until after reboot.)Hopefully that works for you.

Hi,I've noticed that event 3351 pops upeven during backup (STSADM), but backup completed OK.So, I followed the instructions and run command line psconfig.exe -cmd secureresourcesThan I restarted my web front end server and run backup again for test. The event 3351 is not showing durig backup anymore!It's posible that PSCONFIG is the solution... well I'll have to wait till tomorrow morning and check my event viewer.tnx,klemen

Unfortunately,this is not the solution, 3351 events are back(20:30PM, 1:30AM, 2:00AM) :( tnx klemen

Hi, Sorry to hear it didn't resolve the issue. The behaviorseems to point to a scheduled job not having proper credentials or having a kerberos issue. Does the event ID 3351 show up at any other time? Are there any jobs running at those times that you can see when you check the timer job status? Are you using kerberos?If you are using kerberos are you seeing kerberos errors in your security log at the same time these Event ID 3351 s are showing up?Sincerely, Karl

We were just struggling with this issue and tracked it down to the VSS Writer service. We're running a farm with 2 WFEs, 2 Application Servers and a clustered SQL Server. We recently began using DPM for our SP backups which required the Windows SharePoint Service VSS Writer be active on one of the WFE. This service is running with our AD farm account. We discovered the service is also running on our Index server but with the local system account. The index server application log was full of these errors and the DB log had corresponding errors. We changed the service to run with the AD farm account and the errors resolved. We're still investigating why this service is trying to access the DB...

Hi,No, event 3351 show up on (20:30PM - ARCServe backup, 1:30AM - STSADM backup , 2:00AM - ??). I'm not using kerberos. Windows sharepoint services vss writer service is running under Local sytem account, so I'll try to run it under AD farm account. Maybe this will help.Is it possible that this issue is somehow related with security updates for windows server 2008? I've got 6 security updates for windows (KB960714, KB958687, KB958624, KB958623, KB958215, KB956802) and Hotfix KB946517 installed on 22.01.2009 - after that date my events 3351 started What about uninstalling security updates? tnxklemen

Hi,Running Windows sharepoint services vss writer service under AD farm account is the solution of my issue! I'm so happy :)Tnx,Klemen

We found that this started happening a server in the Indexer role in our production farm environment when someone turned the Windows sharepoint services vss writer service on, whereas in our test environment this was turned off. So to solve the issue we turned it off again.

I disabled the IIS anonymous account on the WFE. It's a security risk anyway. IUSR_[servername] Built-in account for anonymous access to Internet Information Services It doesn't give you the underlaying cource but it helps te get rid off the annoying 3351 errors. Good luck, Arnt

Hi All, I resolved this with giving permissions on the domain user using the account.User had dbowner but it didn't work. Granted the user dbcreator and securityadmin and it successfully started the service. I then had to do the following... Verify the Windows SharePoint Search Service is running 1) Open the Central Admin and click Operations | Services on Server 2) In the Server dropdown, choose the server in which you would like to run this service 3) Click the 'Start' link next to Windows SharePoint Services Search 4) Enter the required information and press OK Assign the content databases to the indexer 1) Open the Central Admin and click Application Management | Content Databases 2) In the Web Application dropdown, choose the web application you would like to make changes to 3) Click the database you would like to modify 4) In the Search Server section, choose the indexer, then press OK 5) Repeat steps 3 and 4 for all databases 6) Repeat steps 2-5 for all web applications Start a full WSS crawl 1) Open a command prompt and browse to the following location: C:\Program Files\Common Files\Microsoft Shared\web server extensions\12\bin 2) Run the following command stsadm -o spsearch -action fullcrawlstart 3) Allow some time for the sites to be indexed Best of luck. This issue can be very frustrating. Bobby