Logon type 3 and event 529

  • Thread starter Thread starter Bryan Bowers
  • Start date Start date
B

Bryan Bowers

Howdy Everyone,

I have seen a number of 529 errors in the security event log with a logon
type of 3.

Are logon type 3 only generated from inside the network or can they also be
generated from an outside connection (terminal services, Outlook Web Access,
VPN, etc).

Thanks in advance for your help.
 
Terminal services for Windows 2000 is considered type 2 console logon. In Windows
2003 I think it gets it's own logon type of 10. Other than TS, type 3 logon would be
any logon attempt other than console/keyboard logon. Type 3 can originate from the
internet if there is no or an improperly configured firewall as users attempt to hack
ports such as 139 and 445 tcp. The link below is a good read on using the security
log and intrusion detection for windows. --- Steve

http://www.microsoft.com/technet/security/guidance/secmod144.mspx

http://www.microsoft.com/resources/...wsserv/2003/datacenter/proddocs/en-us/518.asp
 
Back
Top