Posted on:
Categories: SharePoint

​I was recently tasked with addressing a series of errors that had been occurring very frequently on one of our SharePoint servers.

Description: SQL Database login for 'SPFarm_Config' on Instance 'SP2010SQL' failed. Additional error Information from SQL Server is included below.

Login failed for user 'Domain\ServerName'

Event ID: 3351

By using SQL Profiler and the timestamp from the event log item we were able to identify the process ID(PID) of the process that was generating the error.

Now that I had the PID I was able to open Process Monitor on the affected server and identify the offending process. It turned out that the offending process was PowerShell.exe. Drilling into the event properties I was able to see the exact command that was being run

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy RemoteSigned -Command "&{.\FASTContentPluginDiscovery.ps1 '{FBBF9CEA-9F7D-BFA0-613A-F7940C05FC3C}' '{26B375A8-C8CF-EEB8-780B-0651251A2FA7}' 'serverName' 'Content Plugin (serverName)'}"

Running an online search for FASTContentPluginDiscovery.ps1 allowed me to identify SCOM (System Center Operations Manager) as the application that was invoking PowerShell and executing the aforementioned command.

I contacted the SCOM team and alerted them about the errors that were being generated by the PowerShell command. The SCOM team was able to resolve the issue by removing the affected server from the SCOM class that the FAST Content Plugin discovery was targeted to.

The server under consideration does not run FAST, so it made sense to remove it from the SCOM class.