Login failed for user ‘NT AUTHORITY\ANONYMOUS LOGON’ on the BizTalk database server after upgrading SCOM.


After upgrading our SCOM version to 2007 R2, I start to receive the error “Login failed for user ‘NT AUTHORITY\ANONYMOUS LOGON’” on the BizTalk database server. The login failure was occurring every 5 minutes. First I read the standard trace from SQL to get more information. In the standard trace I could see the process ID that was causing the login failure. The next step was to login on the BizTalk server and see which process was generating the login failures; I then found out that the process generating the error was the “wmiprvse.exe”. Then together with one of the system engineers we looked in the event viewer to see if there were other errors occurring at the time of the login failures. We saw that the in the operations manager event log were a lot of warnings and the times were exactly the same as the login failures time. There were three warnings; below you can see the warnings:

Event Type:      Warning

Event Source:  Health Service Modules

Event Category:            None

Event ID:          10409

Date:                DD/MM/YYYY

Time:               HH:MM:SS

User:                N/A

Computer:        SERVERNAME

Description:

Object enumeration failed

Query: ‘SELECT * FROM MSBTS_GroupSetting WHERE Name = ‘BizTalk Group”

HRESULT: 0xc0c025ca

Details:

One or more workflows were affected by this.

Workflow name: Microsoft.BizTalk.Library.BizTalkGroup.Discovery

Instance name: Microsoft.BizTalk.2006.BizTalkServer.ServerRole

Instance ID: {XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX}

Management group: Management group name

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.


Event Type:      Warning

Event Source:  Health Service Modules

Event Category:            None

Event ID:          10409

Date:                DD/MM/YYYY

Time:               HH:MM:SS

User:                N/A

Computer:        SERVERNAME

Description:

Object enumeration failed

Query: ‘SELECT * FROM MSBTS_server’

HRESULT: 0x80131904

Details:

One or more workflows were affected by this.

Workflow name: Microsoft.BizTalk.2006.BizTalkServer.LocalApplication.Discovery

Instance name: Microsoft.BizTalk.2006.BizTalkServer.ServerRole

Instance ID: {XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX}

Management group: Management group name

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:      Warning

Event Source:  Health Service Modules

Event Category:            None

Event ID:          10409

Date:                DD/MM/YYYY

Time:               HH:MM:SS

User:                N/A

Computer:        SERVERNAME

Description:

Object enumeration failed

Query: ‘SELECT * FROM MSBTS_HostSetting’

HRESULT: 0x80131904

Details:

One or more workflows were affected by this.

Workflow name: Microsoft.BizTalk.Library.Host.Discovery

Instance name: Microsoft.BizTalk.2006.BizTalkServer.ServerRole

Instance ID: {XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX}

Management group: Management group name

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.


At that moment we knew the problem was caused by SCOM, but we still didn’t know how to solve the problem. Then my colleague found a post on Microsoft TechNet where the solution to the problem was explained. After following the steps shown in the Microsoft TechNet post the problem was solved. You can find the TechNet post on this link http://social.technet.microsoft.com/Forums/en-US/operationsmanagermgmtpacks/thread/cb63fb92-41e7-495e-9e1c-cf790a37ff82. If you are experiencing this problem I hope this post will help you. In case you have any questions don’t hesitate to contact me.

Advertisements

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s