Failure Audit
From: Bob (Bob_at_discussions.microsoft.com)
Date: 10/29/04
- Next message: Bob: "Failure Audit"
- Previous message: Bob: "Failure Audit"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Date: Fri, 29 Oct 2004 09:13:06 -0700
Every ten minutes I get four hits in the DC security logs for the following:
Event Type: Failure Audit
Event Source: Security
Event Category: Account Logon
Event ID: 681
Date: 10/29/2004
Time: 10:53:41 AM
User: NT AUTHORITY\SYSTEM
Computer: MAS200
Description:
The logon to account: mooret
by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
from workstation: TIM-MOBILE
failed. The error code was: 3221225586
The mooret account is disabled, and the primary user of the Tim-Mobile
workstation used to be mooret before he left.
There are no services on the machine trying to use that account and I have
no idea what is running on that machine that is trying to logon to the DC.
How can I track it down?
Thanks, Bob
- Next message: Bob: "Failure Audit"
- Previous message: Bob: "Failure Audit"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
|
