I am in the process of trying to identify a client application which uses one of the SQL Servers I support (2008 R2). Periodic queries against sys.dm_exec_sessions regularly return sessions whose login_name is, variously, either one of two non-system SQL-authenticated accounts, or a single, specific, non-system local Windows account, on the machine that hosts the SQL Server instance. The value in program_name is 'Microsoft SQL Server'; the value in host_name is the name of the server in question; and the value in host_process_id points to the sqlserver.exe process on the same server (as cross-referenced via Task Manager).
My question is, what mechanism could be initiating these sessions using the host_process_id associated with the engine executable itself? I realize program_name is configurable by any application, but I didn't think that was true for host_process_id. A SQL Agent job would connect from a separate executable, as would sqlcmd or the data collection utility. To my knowledge, we don't use Service Broker for any user applications. Could it be coming from another engine instance as a linked-server connection? I feel like I'm missing something that should have been obvious. How can I track this down?
There are multiple session_ids, all greater than 50, and all with user-created login names, not 'sa' or any account typically used by an internal process. The sessions also run queries against application tables in user databases.
