RE: All of a sudden ASPNET account cannot login?

From: Sandy Wood (sandy.wood@da.ocgov.com)
Date: 04/02/03 

From: "Sandy Wood" <sandy.wood@da.ocgov.com>
Date: Wed, 2 Apr 2003 08:02:13 -0800

Here's the Event log info...I get 4 of these differing
only in logon type...first a 3,8,2 and 5. This has
happened on all my DCs - my solution was to simply
uninstall the .NET framework. I'd still like to know why
all of a sudden this is happening.

Event Type: Failure Audit
Event Source: Security
Event Category: Logon/Logoff
Event ID: 529
Date: 4/1/2003
Time: 8:17:01 AM
User: NT AUTHORITY\SYSTEM
Computer: OCDAHOC
Description:
Logon Failure:
         Reason: Unknown user name or bad password
         User Name: ASPNET
         Domain: OCDAHOC
         Logon Type: 3
         Logon Process: Advapi
         Authentication Package:
        MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
         Workstation Name: OCDAHOC

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

>-----Original Message-----
>Hi Sandy,
>
>Would you please post the full event log like below:
>
>Event Type: Failure Audit
>Event Source: Security
>Event Category: Logon/Logoff
>Event ID: 529
>Date: 6/27/2002
>Time: 5:00:19 PM
>User: NT AUTHORITY\SYSTEM
>Computer: LIVEDB004
>Description:
>Logon Failure:
> Reason: Unknown user name or bad password
> User Name: jgoings
> Domain: WEBTRENDS_CORP
> Logon Type: 3
> Logon Process: NtLmSsp
> Authentication Package:
        MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
> Workstation Name: JGOINGS
>
>
>Regards,
>
>Jeff Qiu
>jefffqiu@online.microsoft.com
>Online Support Professional
>Microsoft Corporation
>
>This posting is provided Ħ°AS ISĦħ with no warranties,
and confers no
>rights.
>
>--------------------
>>Content-Class: urn:content-classes:message
>>From: "Sandy Wood" <sandy.wood@da.ocgov.com>
>>Sender: "Sandy Wood" <sandy.wood@da.ocgov.com>
>>Subject: All of a sudden ASPNET account cannot login?
>>Date: Thu, 27 Mar 2003 08:56:58 -0800
>>microsoft.public.win2000.security
>>
>>This morning I noticed one of my domain controllers
>>(Win2k, Native AD) started loading its Security Event
>>logs up with Logon/Logoff Failures ID 529 for User name
>>ASPNET. They were showing up 5 at a time every 24
seconds
>>or so. I happened to install the .NET framework many
>>months ago thinking it was OK to do, I didn't have any
>>real need to, just Windows Updated it. None of my other
>>DCs are having this problem.
>>
>>I've un-installed the .NET framework and the failures
are
>>stopping. Why is this suddenly happening?
>>
>
>.
>

Relevant Pages

  • Re: Problem logging in OWA (Exchange 5.5)
    ... and the event log shows: ... The server was unable to logon the Windows NT account 'username' due to the ... following error: Logon failure: the user has not been granted the requested ...
    (microsoft.public.exchange.admin)
  • event id 537 in security log - Kerberos culprit but no K logging
    ... I'm receiving the following in the event log of a W2k sp4 ... Logon Failure: ... not receive any corresponding detail entries in the event ...
    (microsoft.public.win2000.security)
  • Re: obscure logon events?
    ... These don't explain reason of these event entries. ... Logon even: 540 A user successfully logged on to a network. ... You can safely ignore this event log and it should ...
    (microsoft.public.windows.server.sbs)
  • Re: Preparing Network Connections... forever
    ... Windows IP Configuration ... Connection-specific DNS Suffix. ... "Replication Services" event log contained the same error as originally posted. ... The failure code from authentication protocol Kerberos was "There are currently no logon servers ...
    (microsoft.public.windows.server.active_directory)
  • Re: Failure Audit 537 in Event Log
    ... You get the event 537 in SBS event log. ... Microsoft CSS Online Newsgroup Support ... This newsgroup only focuses on SBS technical issues. ... | Logon Failure: ...
    (microsoft.public.windows.server.sbs)