Re: Failure Audit

From: Jeff Qiu (jefffqiu@online.microsoft.com)
Date: 12/03/02


From: jefffqiu@online.microsoft.com (Jeff Qiu)
Date: Tue, 03 Dec 2002 09:48:41 GMT

Hi Derek,

Based on my further research, I suggest you enable the Guest account which
allows the RPC calls to succeed to the server.

Regards,

Jeff Qiu
jefffqiu@online.microsoft.com
Online Support Professional
Microsoft Corporation

This posting is provided Ħ°AS ISĦħ with no warranties, and confers no
rights.

--------------------
>From: "Derek Hamilton" <derek@capweb.com>
>References: <OnRLW#kmCHA.1964@TK2MSFTNGP08> <5YZjkInmCHA.2228@cpmsftngxa09>
>Subject: Re: Failure Audit
>Date: Mon, 2 Dec 2002 20:42:38 -0800
>microsoft.public.win2000.security
>
>Hi Jeff,
>
>Thanks for your reply, it's much appreciated. I understand what you're
>saying however I don't honestly see how it applies here. The cause is a
>pop/imap connection to the Exchange server while the effect is the failure
>audit on the person's account who is accessing his/her account.
>
>Thanks,
>Derek
>
>
>"Jeff Qiu" <jefffqiu@online.microsoft.com> wrote in message
>news:5YZjkInmCHA.2228@cpmsftngxa09...
>> Hi Derek,
>>
>> Cause:
>> Enterprise Manager makes an NTLM connection because to poll it needs to
>> Ping/check with the OS that
>> SQL is started so it needs an NT connection rather then SQL
>>
>> Solution:
>> - on domain where you are opening the Enterprise manager.
>> - go to Enterprise Manager; TOOLS; OPTIONS; on the general tab UNCHECK
>> POLLING
>> - RESTART Enterprise Manager.
>>
>> Regards,
>>
>> Jeff Qiu
>> jefffqiu@online.microsoft.com
>> Online Support Professional
>> Microsoft Corporation
>>
>> This posting is provided Ħ°AS ISĦħ with no warranties, and confers no
>> rights.
>>
>> --------------------
>> >From: "Derek Hamilton" <derek@capweb.com>
>> >Subject: Failure Audit
>> >Date: Mon, 2 Dec 2002 14:03:04 -0800
>> >microsoft.public.win2000.security
>> >
>> >I run a small Exchange server for some scattered employees, etc. These
>> >employees logon mainly using POP3 or IMAP to retrieve their mail. All
is
>> >fine with the Exchange services and them receiving there email.
However,
>> >every time they check their mail a Failure Audit is showing up.
>> >
>> >Security
>> >Account Login
>> >681
>> >The logon to account: ...
>> >by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
>> >from workstations: ....
>> >failed. The error code was: 3221225572
>> >
>> >The technet docs say this is a bad password or bad username but they are
>> >able to log on and retrieve their mail, etc.
>> >
>> >Any idea why this audit would show up yet these people can still in
>reality
>> >logon?
>> >
>> >TIA,
>> >Derek Hamilton
>> >
>> >
>> >
>> >
>>
>
>
>



Relevant Pages

  • Re: How to add NT4 Server to SBS2003 domain?
    ... So one has to create an account in SBS2003 first before NT will be ... >> either as a member server or just as a PC that shares files? ... > Regards. ...
    (microsoft.public.windows.server.sbs)
  • Re: Unknown User Logon attempt
    ... than likely something is using that user account. ... > I'm trying to track down a user logon attempt on one of my servers. ... > Whenever I reboot one of my member server i get an event 681/529. ... > Event Type: Failure Audit ...
    (microsoft.public.security)
  • Re: NT AUTHORITYANONYMOUS LOGON --- SQL server
    ... >> Well in regards to add the log in name to the SQL server I just did the ... >> and testing my code on a workstation so there is no second server at this ... > Create the same account on both machines. ...
    (microsoft.public.dotnet.languages.csharp)
  • Re: Forgotten password on MS SQL server
    ... However if your SQL server runs under a domain or ... local account rather than Local System then you can log ... into the console of the server as that account and then ... >>> Regards, ...
    (microsoft.public.sqlserver.security)
  • Re: 550 when connecting
    ... The FTP client account had Log on Locally ... >access to the remote server, but not the actual FTP server. ... >>> Regards, ... >>> Bernard Cheah ...
    (microsoft.public.inetserver.iis.ftp)