SQL Server has a long history of failed login attempts into the SA user , occuring about 50 times every 10-20 minutes. and Extended Event auditing shows that the client_app_name is "Microl office":
The PID refers to sqlserver.exe.
- Incoming remote connections is disabled for this server so it can't be coming from outside the machine...
- No firewall rule exist for SQL server so incoming connections are blocked there too
- No jobs are attempting to login
Any ideas what else this could be or suggestions?
