Does anyone know what application name SMS_MP_FILE_DISPATCH_MANAGER is? It's throwing an error.

Question

This is the audit log in SQL Server. It shows the following login failed. From the SQL Server side, this is all I can see. What I wonder what is SMS_MP_FILE_DISPATCH_MANAGER and how do I verify what account it's running at? How do I go about troubleshooting this error further?

Date 2/4/2021 2:34:01 AM
Log Audit Collection (LoginFailed)

Event Time 02:34:01.6182729
Server Instance Name DevDB
Action ID LOGIN FAILED
Class Type LOGIN
Sequence Number 1
Succeeded False
Permission Bit Mask 0x00000000000000000000000000000000
Column Permission False
Session ID 0
Server Principal ID 0
Database Principal ID 0
Target Server Principal ID 0
Target Database Principal ID 0
Object ID 0
Session Server Principal Name
Server Principal Name NT AUTHORITY\SYSTEM
Server Principal SID NULL
Database Principal Name
Target Server Principal Name
Target Server Principal SID NULL
Target Database Principal Name
Database Name
Schema Name
Object Name
Statement Login failed for user 'NT AUTHORITY\SYSTEM'. Reason: Failed to open the explicitly specified database 'dbName'. [CLIENT: <local machine>]
Additional Information <action_info xmlns="http://schemas.microsoft.com/sqlserver/2008/sqlaudit_data"><pooled_connection>0</pooled_connection><error>0x00004818</error><state>38</state><address>local machine</address></action_info>
File Name C:\Temp\SQLAuditFiles\LoginFailed_C9114B7D-590B-48B9-8978-D40508F15326_0_132568475672460000.sqlaudit
File Offset 10240
User Defined Event ID 0
User Defined Information
Sequence Group ID 0x1D52222EBA21AE4E884DD7A55652AC6C
Transaction ID 0
Client IP local machine
Application Name SMS_MP_FILE_DISPATCH_MANAGER
Affected Rows 0
Response Rows 0
Connection Id 1429ba8e-ca3c-4391-b7e8-0792f5a655c7
Duration Milliseconds 0
Data Sensitivity Information

Message

Answer 1

That is a "System Center Configuration Manager" component.

Answer 2

Is there something on the SCCM side that I can verify? I've looked at the mpfdm.log and there is no error.

Answer 3

@CharlieLor
Thank you for posting in Microsoft Q&A forum.
SMS_MP_FILE_DISPATCH_MANAGER is a component of SCCM, you may check the component status to see if there any error or warning like below:

---

If the response is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 4

Here's something I'm still confused about this error. Based on the audit, it said the client is <local machine> so that means it's coming from the same server that's hosting the DevDB SQL Server instance. However, SMS_MP_FILE_DISPATCH_MANAGER is not installed on the DevDB SQL Server instance. SCCM is installed in a separate VM server. So, how can <local machine> which does not have SMS_MP_FILE_DISPATCH_MANAGER installed tried to access itself with System and failed?

Answer 5

That's indeed mysterious.

Although, there is a possibility. The application name is taken from the connection string, so there could be a process on the local machine pretends to be SMS_MP_FILE_DISPATCH_MANAGER. I am not going deny that this sounds far-fetched, but sometimes crazy things happen.

Here is an idea to track this down, although it is not entirely recommendable from a security perspective.

Create the database in question and grant NT AUTHORITY\SYSTEM access to it. Then write a logon trigger first checks if the user is NT AUTHORITY\SYSTEM, and if so captures host_process_id and writes it to a table. Furthermore, the logon trigger would run xp_cmdshell and run a command to list all processes, redirecting the output to a file. Once you have a host_process_id, you can look for it in the file.

I would definitely be hesitant to do this in production, but given the DB name, I assume that this is a Dev instance?