change administrator password

From: Bob (bob_at_hotmeel.com)
Date: 09/16/04

  • Next message: PC: "Re: Blocking Port:445 on Windows 2000 Professional" 
    Date: Thu, 16 Sep 2004 11:40:14 +0200

    We have 2 domaincontrollers with Windows 2000 Server SP3.
    Since I changed the administrator password, I get a lot of these events in
    the Security Event Viewer (see below).

    Is it possible that some processes or programs still try to use the old
    password?
    Is there a procedure to follow when changing the administrator password,
    just to be sure that the new password is transfered to all processes on all
    the DC's.
    I also have some PC's which are used p.e. as printserver or antivirus
    updateserver, that start with the administrator password or wiht a user with
    administrator priviliges. Is there a way to submit the new administrator
    password to processes that run on such PC's?

    I must say, all the programs that run on our servers : Exchange, Arcserve
    Backup, F-Secure Antivirus, Progress Database,... seem to work fine.
    So why all these event messages?

    Kind regards,

    Bob Goetschalckx

    Event Type: Failure Audit
    Event Source: Security
    Event Category: Logon/Logoff
    Event ID: 529
    Date: 10/09/2004
    Time: 20:11:32
    User: NT AUTHORITY\SYSTEM
    Computer: NameOfDC
    Description:
    Logon Failure:
      Reason: Unknown user name or bad password
      User Name: out_domain\Administrator
      Domain: NameOfDC
      Logon Type: 3
      Logon Process: Advapi
      Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
      Workstation Name: NameOfDC

    Event Type: Failure Audit
    Event Source: Security
    Event Category: Account Logon
    Event ID: 681
    Date: 10/09/2004
    Time: 20:11:32
    User: NT AUTHORITY\SYSTEM
    Computer: NameOfDC
    Description:
    The logon to account: out_domain\Administrator
     by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
     from workstation: NameOfDC
     failed. The error code was: 3221225572

    Event Type: Failure Audit
    Event Source: Security
    Event Category: Account Logon
    Event ID: 677
    Date: 10/09/2004
    Time: 15:12:25
    User: NT AUTHORITY\SYSTEM
    Computer: NameOfDC
    Description:
    Service Ticket Request Failed:
      User Name: NameOfDC$
      User Domain: out_domain
      Service Name: krbtgt/our_domain
      Ticket Options: 0x2
      Failure Code: 0x20
      Client Address: 127.0.0.1

    Event Type: Failure Audit
    Event Source: Security
    Event Category: Logon/Logoff
    Event ID: 529
    Date: 10/09/2004
    Time: 10:11:13
    User: NT AUTHORITY\SYSTEM
    Computer: NameOfDC
    Description:
    Logon Failure:
      Reason: Unknown user name or bad password
      User Name: administrator
      Domain: our_domain
      Logon Type: 2
      Logon Process: User32
      Authentication Package: Negotiate
      Workstation Name: NameOfDC

    Event Type: Failure Audit
    Event Source: Security
    Event Category: Account Logon
    Event ID: 677
    Date: 16/09/2004
    Time: 5:01:03
    User: NT AUTHORITY\SYSTEM
    Computer: NameOfDC
    Description:
    Service Ticket Request Failed:
      User Name: NameOfDC$
      User Domain: out_domain
      Service Name: ldap/NameOfDC.our_domain.be
      Ticket Options: 0x40810010
      Failure Code: 0x6
      Client Address: 127.0.0.1

  • Next message: PC: "Re: Blocking Port:445 on Windows 2000 Professional"

    Relevant Pages

    • Rogue Workstation?
      ... I noticed the following entries in the Security log of one of my Windows ... Event Type: Failure Audit ... The logon to account: Administrator ...
      (microsoft.public.windows.server.active_directory)
    • Re: Help - RPC over http credential issue
      ... I am showing the following errors in my DC event security log: ... Event Type: Failure Audit ... Logon Failure: ...
      (microsoft.public.exchange.setup)
    • Re: Security failures
      ... I send a copy of the text to the security people who contact the person at the noted workstation and tell them not to run scripts or programs which check every machine on every domain in the world. ... Event Type: Failure Audit ... An unexpected error occurred during logon ...
      (microsoft.public.win2000.general)
    • Security failures
      ... I have been geeting the fallowing errors often in my security log. ... Event Type: Failure Audit ... An unexpected error occurred during logon ...
      (microsoft.public.win2000.general)
    • Re: Logon Error - Event ID 533
      ... The suggestion regarding security logs should not apply if the overwrite option has been selected and you have the default maximum of 512 kb. ... How to Set Log Size and Overwrite Options ... The user cannot logon and no Profile folder is made, ... screen whether with a domain account or a local account from the ...
      (microsoft.public.windowsxp.help_and_support)