Security Log Events

From: Phil Margolies (@)
Date: 03/28/03 

From: "Phil Margolies" <p m a r g @ b e l l s o u t h . n e t>
Date: Fri, 28 Mar 2003 10:49:58 -0500

For several weeks now I have been seeing security log failure audit events
(see below). These are commning from workstations that are not on our local
network. However, they may be comming from other networks to which we are
attached. In the log it only shows the NetBIOS name, not the IP address. I
can't ping by name. How can I track down where this is coming from? TIA

Event Type: Failure Audit
Event Source: Security
Event Category: Account Logon
Event ID: 681
Date: 3/28/2003
Time: 10:39:30 AM
User: NT AUTHORITY\SYSTEM
Computer: DC1
Description:
The logon to account: Administrator
 by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
 from workstation: \\COMPUTERNAME
 failed. The error code was: 3221225578

Relevant Pages

  • Re: Unable to add users to local groups on member workstations
    ... Anyway the network trace I was talking about wasn't a tracert, it was a sniff of the network traffic with netmon or wireshark or something. ... Joe Richards Microsoft MVP Windows Server Directory Services ... Once I fixed DHCP on the Firebox, computer management worked normally on the workstations. ... "Brian P." wrote: ...
    (microsoft.public.windows.server.active_directory)
  • Re: Bandwidth consumption
    ... had the time to try and troubleshoot. ... I suggest running combination of perfmon.exe (with Network Interface ... Shut down one of the workstations and see if that makes difference. ...
    (microsoft.public.security)
  • Re: Mystery hardware query
    ... Nestar did a brief negotiation using an arbitration handshake to confirm ... Workstations weren't expecting to receive unsolicited data, ... but they polled the network themselves. ... station would send a request packet, ...
    (comp.sys.apple2)
  • RE: Server shared drives inaccessible
    ... The network disconnections are happening on ALL workstations. ... I asked that all workstations get restarted at the beginning of the workday. ... regularly lose their ability to access a shared drive on the SBS. ... click to check the "Hide All Microsoft Services" ...
    (microsoft.public.windows.server.sbs)
  • Re: Sharing client printers
    ... different approach to providing printers to the workstations?? ... SBS has no firm limit on maximum workstations. ... When you have a network-attached printer in an SBS network it's usually best ... And you can no longer install ...
    (microsoft.public.windows.server.sbs)