Re: Logon Attempt Failed (Security Log)

From: Johnb (anonymous_at_discussions.microsoft.com)
Date: 05/24/04 

Date: Mon, 24 May 2004 11:16:23 -0700

>-----Original Message-----
>What is the exact content of the failure audits that you
get in the event
>log?
>--
>Regards,
>Adrian Grigorof
>www.eventid.net
>Event Log UnDump: http://www.altairtech.ca/elundump/
>
>"Johnb" <anonymous@discussions.microsoft.com> wrote in
message
>news:1160f01c441b1$17d5f050$a301280a@phx.gbl...
>> I need help.
>> About 4 to 5 'Failed logon attempts' a day have been
>> logged on my computer for the last three weeks. The
event
>> identifies the workstation within our LAN that is
>> attempting the logon. However, the event is logged even
>> when that person is not present. I suspect a virus of
>> some kind but regular weekly scans have not detected
any.
>> I have kept the virus files (Norton) updated on a daily
>> basis.
>> How do I identify what is causing the logon attempts and
>> more importantly, how do I correct it.
>>
>>
>
>
>.
>The windows displays:
Date 5/24/04 Source Security
Time ..... Category Account Logon
Type Failure Event ID: 681
User NT Authority\System
Computer S.....
Description
Logon Failure
      Reason: Unknown user name or password
      User Name: M.....
      Domain: DTN
      Logon Type: 3
      Logon Process: NtLmSsp
      Aut...Package: NTLM
       

Relevant Pages

  • Re: Is it really true that NTFS is secure?
    ... > and failure auditing starting with "Audit Account Management," and also try ... > The account Group got put back in the Administrator group again. ... > The logon to account: ...
    (microsoft.public.security)
  • Re: Is it really true that NTFS is secure?
    ... and failure auditing starting with "Audit Account Management," and also try ... The account Group got put back in the Administrator group again. ... The logon to account: Administrator ...
    (microsoft.public.security)
  • Re: Cant install ADAM master on XP SP2
    ... Also enabling "Audit Logon events" for success and failure in the local ... incompatible with ADAM? ...
    (microsoft.public.windows.server.active_directory)
  • Re: Help, Ive been hacked
    ... Event Type: Failure Audit ... Logon attempt by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 ... Thanks for the help Wes, ...
    (microsoft.public.windowsxp.security_admin)
  • Re: Worrying Security Event
    ... The machine is using a machine local account. ... Logon failure auditing is enabled. ... Windows will write event ID 529 to the log file ...
    (microsoft.public.windowsxp.basics)