Re: Mysterious login failures

From: Eric Fitzgerald [MSFT] (ericf_at_online.microsoft.com)
Date: 07/11/03 

Date: Fri, 11 Jul 2003 13:34:38 -0700

The error code below, converted to hex, maps to:
#define STATUS_NO_SUCH_USER ((NTSTATUS)0xC0000064L)
(from ntstatus.h in the Platform SDK)

Anyone who clicks "Network Neighborhood" on a shared network, including many
broadband cable networks, can potentially cause this.

The solution is to install a firewall on your machine, or use Internet
Connection Firewall on Windows XP.

If you have only the one computer at home, and you don't use shared files or
printers or a shared internet connection, then you could stop and disable
the Server service and this would also cause the events to cease.

Eric 

-- 
Eric Fitzgerald
Program Manager, Windows Auditing
Microsoft Corporation
The above message is provided "AS-IS" with no warranties, and confers no
rights.
"Shannon Jacobs" <shanen@my-deja.com> wrote in message
news:u#KP11rODHA.2248@TK2MSFTNGP11.phx.gbl...
> I have a W2KP box in a corporate network. Since enabling the audit log for
> login attempts, I've been seeing a pattern of random failures. It doesn't
> seem to be malicious (most of the time), but I'm curious what it's about.
> There are a number of machines in my section, but only two of them make
> periodic attempts to log into my computer. One of them used to share a
> printer, but that was before he replaced his machine, and I had already
> gotten rid of that printer by that time, and he doesn't have any relevant
> driver installed now, so I can't see any link there. The other one has
never
> had any reason to access my computer as far as I know. There are also some
> attempts coming from neighboring sections, and no reason I know of there.
> Most of them are from people I've never heard of.
>
> Yesterday there was a new one, from another person I've never heard of,
> apparently again looking for his personal account on my machine, where it
> has never existed. The event manager entry gives no useful hints, unless
> MICROSOFT_AUTHENTICATION_PACKAGE_V1_0, error code: 3221225572 has some
> ritual significance to someone.
>
> Right now my guess is that these computers have some odd service
installed,
> and they are periodically scanning around, including visiting my machine,
to
> see if my machine is somehow related to their odd service... How to check
> such a thing?
>

Relevant Pages

  • Re: Virtual LAN Problem
    ... The computer browser service uses Netbios names and broadcasts to ... You would only need one WINS server on your network and ALL machines ... >> Network Neighborhood does not work across subnets with a WINS ...
    (microsoft.public.windows.server.networking)
  • Access denied to computer in network neighborhood
    ... access a particular computer in the network neighborhood. ... from the computer "hugo" itself I can go to the network ... other machines can. ...
    (microsoft.public.windowsxp.security_admin)
  • Re: Home Network Probs
    ... >> Network Neighborhood), the problem most likely involves the browser (no I ... As Steven suggested, if there is a firewall interfering, it either has to be ...
    (microsoft.public.windowsxp.network_web)
  • Need expert diagnosis (is there a doctor in the house?)
    ... >server to the same network segment!!!) ... >>I can ping all computers and the DC by both IP and by ... >>network neighborhood on the DC, ...
    (microsoft.public.windows.server.networking)
  • Re: Problem networking Epson C86
    ... So the network printer doesn't appear in the list of printers although ... And, in case I didn't mention it, yes I *did* try to install it as a ... installed as a local printer as well (and I need to keep it that way ... when you eventually get to the printer in Network Neighborhood and right click on it and do the "connect" if that solves the problem. ...
    (comp.periphs.printers)
Quantcast