Hi, I've been using DB2 for about 1 week, so please bear with me.
DB2 Connect Enterprise Edition v8.1 FixPack 5
Windows Server 2003 Standard Edition SP1
Here is an error that continues to appear on our domain controllers
(Security event log):
Event Type: Failure Audit
Event Source: Security
Event Category: Logon/Logoff
Event ID: 529
Date: 8/6/2006
Time: 9:32:38 AM
User: NT AUTHORITY\SYSTEM
Computer: OURDC
Description:
Logon Failure:
Reason: Unknown user name or bad password
User Name: db2admin
Domain: Server A
Logon Type: 3
Logon Process: NtLmSsp
Authentication Package: NTLM
Workstation Name: Server A
Caller User Name: -
Caller Domain: -
Caller Logon ID: -
Caller Process ID: -
Transited Services: -
Source Network Address: Server A's IP
Source Port: 1032
This error occurs for many of the servers running DB2 connect.
I decided to focus on a specific server (Server A) in order to help
resolve this.
The error appears on the domain controller anytime Server A is
restarted.
More specifially, the error occurs anytime the Db2 Administration
Server service (DB2DAS-DB2DAS00) is restarted. The service is run using
the
local admin account (db2admin) that was created prior to installing DB2
connect.
The error would seem to make sense (local account doesn't exist in AD),
especially since
it is always proceeded by this error:
Event Type: Failure Audit
Event Source: Security
Event Category: Account Logon
Event ID: 680
Date: 8/6/2006
Time: 9:32:38 AM
User: NT AUTHORITY\SYSTEM
Computer: OURDC
Description:
Logon attempt by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon account: db2admin
Source Workstation: Server A
Error Code: 0xC0000064
I think that error code means "the specified user does not exist".
I've got auditing turned on for Server A, and it shows the following
successful
logons events approximately 1-2 minutes after the above errors appear
on the DC.
Event Type: Success Audit
Event Source: Security
Event Category: Logon/Logoff
Event ID: 528
Date: 8/6/2006
Time: 9:34:03 AM
User: Server A\db2admin
Computer: Server A
Description:
Successful Logon:
User Name: db2admin
Domain: Server A
Logon ID: (0x0,0x187D4)
Logon Type: 5
Logon Process: Advapi
Authentication Package: Negotiate
Workstation Name: Server A
Logon GUID: -
Caller User Name: Server A$
Caller Domain: OurDomain
Caller Logon ID: (0x0,0x3E7)
Caller Process ID: 564
Transited Services: -
Source Network Address: -
Source Port: -
Event Type: Success Audit
Event Source: Security
Event Category: Logon/Logoff
Event ID: 576
Date: 8/6/2006
Time: 9:34:03 AM
User: Server A\db2admin
Computer: Server A
Description:
Special privileges assigned to new logon:
User Name:
Domain:
Logon ID: (0x0,0x187D4)
Privileges: SeTcbPrivilege
SeCreateTokenPrivilege
SeAssignPrimaryTokenPrivilege
SeSecurityPrivilege
SeBackupPrivilege
SeRestorePrivilege
SeTakeOwnershipPrivilege
SeDebugPrivilege
SeSystemEnvironmentPrivilege
SeLoadDriverPrivilege
SeImpersonatePrivilege
The events may be unrelated, but I wanted to present a timeline of
events nonetheless.
Characteristics of the problem
- The error always appears twice on the DC for Server A.
- For other servers, the error appears, 15 times, or 21 times, or 27
times, or even 33 times.
- The number of occurrences is always consistent for each server.
Meaning, the error always
appears 2 times for Server A, 15 times for Server B, 21 times for
Server C,
21 times for Server D, etc.
- This error does not seem related to any recent changes to our
environment. I've looked at the event logs at it's been happening for
at least 3 months. A colleague told me it's been going on for the past
8 months.
- Some servers running DB2 connect (same version) in our environment do
NOT generate these errors on the DC. They are either using a db2admin
local account (with same pw as Server A's account), or the Local System
account to start DB2DAS.
More info:
db2set -all
[e] DB2PATH=D:\Program Files\IBM\SQLLIB
[i] DB2_ENABLE_LDAP=NO
[i] DB2INSTPROF=D:\Program Files\IBM\SQLLIB
[i] DB2COMM=TCPIP
[g] DB2_GRP_LOOKUP=local
[g] DB2SYSTEM=Server A
[g] DB2PATH=D:\Program Files\IBM\SQLLIB
[g] DB2INSTDEF=DB2
[g] DB2ADMINSERVER=DB2DAS00
db2 get admin cfg
Admin Server Configuration
Authentication Type DAS (AUTHENTICATION) =
SERVER_ENCRYPT
DAS Administration Authority Group Name (DASADM_GROUP) =
DAS Discovery Mode (DISCOVER) = SEARCH
Name of the DB2 Server System (DB2SYSTEM) = Server A
Java Development Kit Installation Path DAS (JDK_PATH) = D:\Program
Files\IBM\
SQLLIB\\java\jdk\
Java Development Kit Installation Path DAS (JDK_64_PATH) =
DAS Code Page (DAS_CODEPAGE) = 0
DAS Territory (DAS_TERRITORY) = 0
Location of Contact List (CONTACT_HOST) =
Execute Expired Tasks (EXEC_EXP_TASK) = NO
Scheduler Mode (SCHED_ENABLE) = OFF
SMTP Server (SMTP_SERVER) =
Tools Catalog Database (TOOLSCAT_DB) =
Tools Catalog Database Instance (TOOLSCAT_INST) =
Tools Catalog Database Schema (TOOLSCAT_SCHEMA) =
Scheduler User ID =
I've tried:
1) Re-entering the password for db2admin in the Services->log on tab.
2) Setting authentication to local (db2set-g DB2_GRP_LOOKUP=local)
So far no dice.
