Re: Masses of 529 Errors!

Thanks, Svyatoslav.

I am running SBS 2K3 with ISA 2004 behind a firewall/router:

Internet -- router -- SBS/ISA -- local LAN

What can I do about this, please?

Cheers,
Bill
"S. Pidgorny <MVP>" <slavickp@xxxxxxxxx> wrote in message
news:O9KKrcDlHHA.596@xxxxxxxxxxxxxxxxxxxxxxx
Splash in a botnets activity?

The access is denied, which is a good thing. Filling up the logs is
something to worry about.

--
Svyatoslav Pidgorny, MS MVP - Security, MCSE
-= F1 is the key =-

* http://sl.mvps.org * http://msmvps.com/blogs/sp *

"Bill Glidden" <billyg1943@xxxxxxxxxxx> wrote in message
news:%23%23a1PiClHHA.4628@xxxxxxxxxxxxxxxxxxxxxxx
I have often seen these errors in the security log at the rate of up to
hundreds in a 24 hour period, but in the last 24 hours I had 107,710 of
them. Is this something I should be worrying about? Obviously the fact
that I know about it means that who/whatever is doing this is
unsuccessful. Below is pasted one of the events:

Event Type: Failure Audit
Event Source: Security
Event Category: Logon/Logoff
Event ID: 529
Date: 11/05/2007
Time: 10:20:37 PM
User: NT AUTHORITY\SYSTEM
Computer: <my sbs server>
Description:
Logon Failure:
Reason: Unknown user name or bad password
User Name: anonymous
Domain:
Logon Type: 3
Logon Process: Advapi
Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Workstation Name: <my sbs server>
User Name: <my sbs server>
Caller Domain: <my domain>
Caller Logon ID: (0x0,0x3E7)
Caller Process ID: 1216
Transited Services: -
Source Network Address: -
Source Port: -

Advice most welcome, please.

Bill







.

Relevant Pages

  • Re: Wrong domain in event log?
    ... The failed login was from the workstation called BCCIJHINSLEY at IP address ... Les Connor [SBS Community Member - SBS MVP] ... Logon Failure: ... Caller User Name: - ...
    (microsoft.public.windows.server.sbs)
  • Re: Stop illegal login attempts?
    ... How can I stop illegal login attempts to my SBS box Exchange server? ... I had a guy last night try for over 3 hours to guess my username/password which generated over 610 security errors in the security event log. ... Logon Failure: ... Caller User Name: WX98$ ...
    (microsoft.public.windows.server.sbs)
  • Re: Error Code 537
    ... Kerberos authentication issues are most often as a result of a time ... Les Connor [SBS Community Member - SBS MVP] ... > Logon Failure: ... > Caller User Name: - ...
    (microsoft.public.windows.server.sbs)
  • Re: Last SBS request for a while... I promise!
    ... With regards to OWA not authenticating, I'm getting the following Failure ... Logon Failure: ... Workstation Name: SBS ... Caller User Name: SBS$ ...
    (microsoft.public.windows.server.sbs)
  • Re: How do increase security?
    ... Les Connor [SBS Community Member - SBS MVP] ... Logon Failure: ... Workstation Name: SERVER ... Caller User Name: SERVER$ ...
    (microsoft.public.windows.server.sbs)