Failure Audit

From: Bob (Bob_at_discussions.microsoft.com)
Date: 10/29/04 

Date: Fri, 29 Oct 2004 09:02:10 -0700

I am getting the following in the DC event log 4 times every ten minutes:

Event Type: Failure Audit
Event Source: Security
Event Category: Account Logon
Event ID: 681
Date: 10/29/2004
Time: 10:53:41 AM
User: NT AUTHORITY\SYSTEM
Computer: MAS200
Description:
The logon to account: mooret
 by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
 from workstation: TIM-MOBILE
 failed. The error code was: 3221225586

The mooret account has been disabled, but I have no idea what is running on
the TIM-MOBILE workstation that is trying to logon to the DC. The person who
used to have that machine was indeed mooret, but there are no services
running on that workstation that use that account.

How can I find out what it is and how to stop it. The workstation in
question is running XP Pro.

Thanks,
Bob
 

Relevant Pages

  • Failure Audit
    ... The mooret account is disabled, and the primary user of the Tim-Mobile ... workstation used to be mooret before he left. ...
    (microsoft.public.win2000.security)
  • Failure Audit
    ... The mooret account is disabled, and the primary user of the Tim-Mobile ... workstation used to be mooret before he left. ...
    (microsoft.public.win2000.security)
  • Re: Trust relationship between this workstation and Primary Domain
    ... it, with a new computer ID, a new workgroup ID, but again to no avail. ... password policy, renamed admin account, automatic updates are controlled by ... * PLEASE post all messages and replies in the newsgroups ... "Workstation ...
    (microsoft.public.win2000.networking)
  • Re: Re-Post - "the trust relationship between this workstation and
    ... account is NEW to the workstation. ... needs admin group priv at workstation level. ... only problem is adding a new user account on the station. ... This would be on the DNS server 172.20.100.2 ...
    (microsoft.public.windows.server.active_directory)
  • Re: Re-Post - "the trust relationship between this workstation and
    ... "the trust relationship between this workstation and the primary domain ... only problem is adding a new user account on the station. ... The DNS Zone for your AD Domain must be DYNAMIC, ... Client computer must use STRICTLY the INTERNAL DNS server which can ...
    (microsoft.public.windows.server.active_directory)