Re: Strange Logon Failure
From: Benjamin F. (anonymous_at_discussions.microsoft.com)
Date: 01/22/04
- Next message: Pinaki: "Error on activex object"
- Previous message: Andrew Raison: "832483 unregistered oledb32.dll"
- In reply to: Steven L Umbach: "Re: Strange Logon Failure"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Date: Thu, 22 Jan 2004 01:56:19 -0800
Hello Steve,
First of all thanks for the reply,
then I did already try to find some infos, but its seems
that I cannot get any informations about this computer no
matter what. What's even more strange that this logon
failures appears on a server in France and another in
Italy .... I'll try to check the firewall logs to see if
anything matches....
Maybe I'll set one of the account below with a blanck
password and no rights, but complete log on this account.
If anyone had some suggestion, they would be welcome.
Thanks again,
Regards,
Benjamin.
>-----Original Message-----
>Some one is trying to access a share via network logon to
computer FCOSNS1
>from apparently computer named MM. I have seen where the
domain name matches
>the computer name when a computer is not a member of a
domain, apparently
>that is the best guess that is put in the Event ID. It
possibly could be a
>laptop computer or such that someone has put on the
network. You might want
>to check your wins database, dhcp leases, or dns zone
records for evidence
>that this was possibly from your network. Pinging by name
may find it if it
>is active on your network. Of course a statically
configured computer would
>probably not leave any of those records behind. Otherwise
check your
>firewall logs to see if anything matches up by time to
those failed
>ogons. --- Steve
>
>"Benjamin F." <anonymous@discussions.microsoft.com> wrote
in message
>news:185901c3e01e$c2cb2600$a001280a@phx.gbl...
>> Hi all,
>>
>> since a week aproximatively, I've got strange entry ( MM
>> user/ computer ) in my security log(...we don't have any
>> MM domain either any MM called worksattion or server...)
>> on some of my 2000 servers accross Europe... they are
like
>> that:
>>
>> Event Type: Failure Audit
>> Event Source: Security
>> Event Category: Logon/Logoff
>> Event ID: 529
>> Date: 1/18/2004
>> Time: 10:27:12 AM
>> User: NT AUTHORITY\SYSTEM
>> Computer: FCOSNS1
>> Description:
>> Logon Failure:
>> Reason: Unknown user name or bad password
>> User Name: wwwadmin
>> Domain: MM
>> Logon Type: 3
>> Logon Process: NtLmSsp
>> Authentication Package:
>> MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
>> Workstation Name: MM
>>
>>
>>
>> Event Type: Failure Audit
>> Event Source: Security
>> Event Category: Logon/Logoff
>> Event ID: 529
>> Date: 1/18/2004
>> Time: 10:27:23 AM
>> User: NT AUTHORITY\SYSTEM
>> Computer: FCOSNS1
>> Description:
>> Logon Failure:
>> Reason: Unknown user name or bad password
>> User Name: Administrator
>> Domain: MM
>> Logon Type: 3
>> Logon Process: NtLmSsp
>> Authentication Package:
>> MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
>> Workstation Name: MM
>>
>>
>> The logon to account: Administrator
>> by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
>> from workstation: MM
>> failed. The error code was: 3221225578
>>
>>
>> Does anyone have an idea of what it could be plz ???
>>
>> Thanks in advance,
>>
>> Benjamin.
>>
>>
>
>
>.
>
- Next message: Pinaki: "Error on activex object"
- Previous message: Andrew Raison: "832483 unregistered oledb32.dll"
- In reply to: Steven L Umbach: "Re: Strange Logon Failure"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
