Logon mystery

  • Thread starter Thread starter Silvio
  • Start date Start date
S

Silvio

Hi!

On win2000 server SP3 I get following error every 5 minutes:

Event Type: Failure Audit
Event Source: Security
Event Category: Logon/Logoff
Event ID: 529
Date: 7/30/2003
Time: 10:25:14
User: NT AUTHORITY\SYSTEM
Computer: Server01
Description:
Logon Failure:
Reason: Unknown user name or bad password
User Name: Administrator
Domain: MyDomain
Logon Type: 3
Logon Process: NtLmSsp
Authentication Package: NTLM
Workstation Name: Server01

Is there a way to track down what is causing this problem.
If there is any additional information required I will be more then glad to
provide it, because I have searched for the solution on Google and MSKB and
failed.

TIA
 
Silvio said:
Hi!

On win2000 server SP3 I get following error every 5 minutes:

Event Type: Failure Audit
Event Source: Security
Event Category: Logon/Logoff
Event ID: 529
Date: 7/30/2003
Time: 10:25:14
User: NT AUTHORITY\SYSTEM
Computer: Server01
Description:
Logon Failure:
Reason: Unknown user name or bad password
User Name: Administrator
Domain: MyDomain
Logon Type: 3
Logon Process: NtLmSsp
Authentication Package: NTLM
Workstation Name: Server01

Is there a way to track down what is causing this problem.
If there is any additional information required I will be more then
glad to provide it, because I have searched for the solution on
Google and MSKB and failed.

TIA
Click to expand...

it means that one of your users probably mistyped their username or password and the server refused
their logon
 
Steve Parry said:
it means that one of your users probably mistyped their username or
Click to expand...
password and the server refused
their logon
Click to expand...

Thank you for your annswer.

Error is logged every 5 minutes 24/7, so I believe that it is caused by some
process. Is there a way to find out which.
 
It looks like Server01 is trying to use the administrator account for
some reason. Since it is happening on a regular interval, a service or other
process may be trying to use it. Look in the Event Viewer on that computer
for any problems with failed services or other error messages that may give
a clue. MS has excellent article on tracking down account failures and
lockouts. See link below and read the white paper "Account Passwords and
Policies" in the overview section. You may also want to look into using some
of the tools available there. --- Steve

http://tinyurl.com/a3es
 
Thank you for your answer.

I came across that tool before but it says:
a.. ALockout.dll. On the client computer, helps determine a process or
application that is sending wrong credentials.
Caution: Do not use this tool on servers that host network applications or
services. Also, you should not use ALockout.dll on Exchange servers, because
it may prevent the Exchange store from starting.

And the problem occurs on there server with Exchange.
 
Back
Top