52

I have created an application pool called "schoolPool" and assigned it to my web application. Identity for this pool has been set to LocalSystem. When I try to access my database from within the application, i.e. open a SQL connection, I get the following error all the time: 

Login failed for user 'NT AUTHORITY\SYSTEM'


I tried to add NT AUTHORITY/SYSTEM to SSMS (SQL Server Management Studio) logins, but it was already a principal, showing the following error:
enter image description here

Mehdi Haghgoo
  • 3,144
  • 7
  • 46
  • 91
  • 3
    Old now, but it needs to be said that it's a **VERY BAD IDEA** to run your web app as local system. Any compromise of the app, no matter how small, now immediately also grants full admin access on the machine. – Joel Coehoorn Dec 27 '18 at 06:14

7 Answers7

144

Allow NT AUTHORITY/SYSTEM to server Role as sysadmin. enter image description here

enter image description here

Musakkhir Sayyed
  • 7,012
  • 13
  • 42
  • 65
  • What if NT AUTHORITY\SYSTEM doesn't exist? I manually created it but still get the same error. – Steve Smith Feb 21 '18 at 16:57
  • 1
    @Steve Smith link help to set NT AUTHORITY\SYSTEM https://stackoverflow.com/questions/6894651/login-failed-login-failed-for-user-nt-authority-system – Sachin Sarola Jan 25 '21 at 10:04
  • In some cases, you need to go to 'User Mapping' and check(select) the database and be sure about the user there. – agileDev Feb 21 '22 at 19:31
59

I tweaked the application settings a lot, changing the application pool's identity (in Windows 8.1's IIS) to LocalSystem, LocalService, NetworkService, and ApplicationPoolIdentity. However, all of them failed to solve the problem I had logging into my database.
Finally I set the pool identity on LocalSystem and thought why it might be preventing "NT AUTHRITY\SYSTEM" from opening a connection to my database. I opened up SQL Server Management Studio as "Administrator" and checked the Server Roles for NT AUTHORITY\SYSTEM under "logins" section. The default server role for this user was public by default. I also checked sysadmin and refreshed my web application form. This time it worked! Everything working perfectly now.

Mehdi Haghgoo
  • 3,144
  • 7
  • 46
  • 91
5

There is another fix. You should open Command Prompt (cmd) and write the following:

sqlcmd -S (server name)

select name from sys.server_principals where name = 'NT AUTHORITY\SYSTEM'

go

SP_ADDSRVROLEMEMBER 'NT AUTHORITY\SYSTEM','SYSADMIN'

go

The first line will give you an access to the sql server on you machine, the second will take the following result NT AUTHORITY\SYSTEM an the stored procedure addsrvrolemember will add sysadmin to it. Be careful, because you have to type the following code the way it is.

Lovepreet Singh
  • 4,792
  • 1
  • 18
  • 36
Georgi Mirchev
  • 261
  • 3
  • 6
3

Rerun following query which will assign 'NT SERVICE\MSSQLSERVER' to sysadmin 

EXEC master..sp_addsrvrolemember @loginame = N'NT SERVICE\MSSQLSERVER', @rolename = N'sysadmin'
Rohan Khude
  • 4,455
  • 5
  • 49
  • 47
Vishe
  • 3,383
  • 1
  • 24
  • 23
2

Musakkhir's answer of granting sysadmin seems poorly thought out as far as security goes, and Pinal's answer involved giving the unknown process db_owner rights, still almost certainly overkill. I've 'solved' it myself by simply granting "public" rights, which normally just allows CONNECT, but nothing else, even SELECT. If gets rid of the login error and stops flooding the error log, since it now logs in, but whatever unknown process is doing the connecting still can't do anything.

Wayne
  • 21
  • 1
  • You should probably use SQL Server Profiler to identify the process that is connecting, rather than granting permissions, if that is what you are concerned about. – John Zabroski Dec 28 '18 at 13:53
1

You should give your User ID and pwd of SQL server authentication login in the connectionStrings as User ID="username";pwd="yourpassword". You can use the following query CREATE LOGIN login name WITH PASSWORD = 'password' ; GO

Supriya Bandela
  • 21
  • 3
1

Please follow the procedure: After database login- Security --> Logins --> NT AUTHORITY\SYSTEM (right click to Properties) --> Server Roles --> sysadmin (Checked)

Roman Hossain
  • 11
  • 1