how many instances of "n" are there in:
q: what's a good approach to finding the source application that's attempting to access a database with an incorrect password? in order to improve our security posture, we changed several dozen internal applications over to using a new username and password to access an as400 database a few months back.
however, there is some mystery process running on a windows server (that hosts our main sql server instance) that is still hitting the as400 with the previous username and password. as400 logs show that the source is this particular windows server.
we have searched everything we could think of to find where this old user/pass is being used.

*

*we changed over our linked servers in sql server.

*we disabled sql agent on that server.

*we check services within windows server.

*we checked windows server scheduled tasks.

*i ran wireshark for 20 minutes to see if i could get a network trace that would provide some clue.

we're running out of ideas. what could you recommend we do to try to locate the source application that is using the old username and password to our as400?

a: sysinternal's procmon for gui, or sysmon if you have any kind of soc/noc/mssp to receive the logs and analyze them.
with procmon, just wait and see which application tried to contact said sql server.
ideally, i'd recommend to try running sysmon ( and winlogbeat ) to ship logs to an elk instance ( there is a free daily 1gb on logz.io that i use on my own lab ).

user
There are seventy-nine "n"s in the text you provided.
assistant