SAM SQL User Experience Monitor logs NT account name with SQL Server Authentication

7/16/2026 7:11 PM

7/16/2026 7:11 PM

SQL Server log entries may be found similar to the following:

• Login failed for user 'domain\account'

• Reason: Attempting to use an NT account name with SQL Server Authentication

• The client IP in the SQL log matches the SolarWinds polling engine or main poller IP.

This does not necessarily mean SSMS is installed or being launched from the poller. The SolarWinds application itself can initiate SQL connections from the polling engine, and those connections can appear in SQL logging as originating from that server.

Server Application Monitor

The SQL Server User Experience Monitor accepts either a Windows credential or a SQL Server credential for monitoring.

By default, SQL User Experience monitors can attempt SQL authentication first and then Windows authentication. When a Windows or domain account is passed through a SQL authentication attempt, SQL Server logs the error that an NT account name is being used with SQL Server Authentication.

The setting named Use Windows Authentication first, then SQL authentication changes the order of authentication attempts so Windows authentication is tried first. This helps reduce or prevent the SQL log noise in environments where a Windows/domain credential is being used for the monitor.

 

 

 

1. In the SolarWinds web console, open the affected application monitor.

2. Click Edit Application Monitor.

3. Expand the affected SQL Server User Experience Monitor component.

4. Locate the setting Use Windows Authentication first, then SQL authentication and enable it.

5. Save the change.

6. Repeat the change for every affected SQL Server User Experience Monitor component in the application, because this setting is component-specific.

How to identify affected components

To list the assigned SAM components and the credentials they are using, run the following SQL query against the SolarWinds database:

-- Scripts are not supported under any SolarWinds support program or service.
-- Scripts are provided AS IS without warranty of any kind. SolarWinds further
-- disclaims all warranties including, without limitation, any implied warranties
-- of merchantability or of fitness for a particular purpose. The risk arising
-- out of the use or performance of the scripts and documentation stays with you.
-- In no event shall SolarWinds or anyone else involved in the creation,
-- production, or delivery of the scripts be liable for any damages whatsoever
-- (including, without limitation, damages for loss of business profits, business
-- interruption, loss of business information, or other pecuniary loss) arising
-- out of the use of or inability to use the scripts or documentation.

SELECT
    Nodes.Caption AS Node,
    Nodes.NodeID,
    APM_Application.Name AS Application,
    APM_Component.Name AS Component,
    Credential.Name AS Credential
FROM APM_ComponentSetting
JOIN APM_Component
    ON APM_Component.ID = APM_ComponentSetting.ComponentID
JOIN Credential
    ON Credential.ID = APM_ComponentSetting.Value
JOIN APM_Application
    ON APM_Component.ApplicationId = APM_Application.ID
JOIN Nodes
    ON APM_Application.NodeID = Nodes.NodeID
WHERE APM_ComponentSetting.[Key] = '__CredentialSetId'
ORDER BY Nodes.Caption, APM_Application.Name, APM_Component.Name;

To review which SQL User Experience Monitor templates currently have the Windows authentication order setting configured, run:

-- Scripts are not supported under any SolarWinds support program or service.
-- Scripts are provided AS IS without warranty of any kind. SolarWinds further
-- disclaims all warranties including, without limitation, any implied warranties
-- of merchantability or of fitness for a particular purpose. The risk arising
-- out of the use or performance of the scripts and documentation stays with you.
-- In no event shall SolarWinds or anyone else involved in the creation,
-- production, or delivery of the scripts be liable for any damages whatsoever
-- (including, without limitation, damages for loss of business profits, business
-- interruption, loss of business information, or other pecuniary loss) arising
-- out of the use of or inability to use the scripts or documentation.

SELECT
    T.Name,
    CT.Name,
    CTS.[Key],
    CTS.Value,
    CTS.ValueType,
    CT.ComponentType
FROM APM_ApplicationTemplate T
JOIN APM_ComponentTemplate CT
    ON T.ID = CT.ApplicationTemplateID
JOIN APM_ComponentTemplateSetting CTS
    ON CT.ID = CTS.ComponentTemplateID
WHERE CTS.[Key] = 'WindowsAuthentication'
  AND CT.ComponentType = 17
  AND CT.ID IN (SELECT DISTINCT ComponentType FROM APM_Component);

Additional notes

The Use Windows Authentication first, then SQL authentication setting changes the order of authentication attempts, but SQL authentication is not always completely disabled as a fallback path. If Windows authentication fails for any reason, SQL authentication may still be attempted depending on the monitor behavior.

If deeper tracing is needed, application debug logs can be reviewed under:

C:\ProgramData\Solarwinds\Logs\APM\ApplicationLogs\AppIdXX