Access Denied error on Mapped Drives (Event ID 529)

  • Thread starter Thread starter WhiteZin2000
  • Start date Start date
W

WhiteZin2000

We have a situation where one user on our network (Sally) periodically can't
access mapped drives on the Windows 2003 Small Bus. Server (also, a domain
controller). Sally's PC is running WinXP (SP1) and the SBS server is
up-to-date on all patches as well. Randomly, she cannot access drives which
are mapped as part of her Group Policy (all other aspects of the Group
Policy seem to be operational). All other network PC's access the server's
drives fine.

In the Event Viewer on the SBS server, there are entries in the Security
log: Event ID 529 (bad username or password). But here is the thing - the
Event Vioewer entries list a different username than wah Sally is using! The
machine name is 'PC1000' but the username in the event listings (event ID
529) is 'jim' - not 'sally'. Jim is another user on the network who logged
into Sally's PC while she was on vacation a year ago. Also, when Sally
prints something to a printer which is shared from the SBS 2003 server, the
entry in the System Events indicates the document was submitted by 'jim' and
not 'sally.

The specific data in the event Viewer regarding Event ID 529 is:
Reason: Unknown Username or bad password
Domain: <servername>
Logon type:3
Logon Process: NtLmSsp
Authentication Package: NTLM
Workstation name: PC1000
Source Network Address: 192.168.1.150
Source port: 1790

I suspect something in the PC's registry may be amiss and it's having an
identity crisis. I've tried deleting and recreating her domain account as
well as unjoining and rejoining the PC into the domain: no success. Any
suggestions appreciated (aside from reinstalling WinXP ;) Thanks!
 
BTW - The 'Source port' number in the Event's starts at '0' and then jumps
to port '1731'. From there it just starts creeping upward.... This system
has Symantec A/V and is up-to-date with definitions...
 
Back
Top