Audit Failures

EMcGrath_at_HCA_NOSPAM_Vendor.com
Date: 03/28/05 

Date: Mon, 28 Mar 2005 04:17:01 -0800

Can anyone tell me if they have seen this type of audit and what does it
mean? We just started auditing, but I am not sure what this is telling me.
This case seems very ambiguious. The other day there were the same entries
but they had user accounts that I know are fine. One of the accounts is mine
and two others that access our server via a VPN connection.

Thanks,

Event Type: Failure Audit
Event Source: Security
Event Category: Logon/Logoff
Event ID: 529
Date: 3/27/2005
Time: 9:09:35 PM
User: NT AUTHORITY\SYSTEM
Computer: [SERVER_X]
Description:
Logon Failure:
         Reason: Unknown user name or bad password
         User Name: Administrator
         Domain: [SERVER_X]
         Logon Type: 3
         Logon Process: NtLmSsp
         Authentication Package: NTLM
         Workstation Name: [SERVER_X]

Relevant Pages

  • Re: Autoexec.nt file missing?
    ... you can't enable Auditing on a computer running Home Edition. ... You must specify what to audit. ... example, a file, folder, registry key, printer, and so forth-that has its ...
    (microsoft.public.windowsxp.newusers)
  • Re: auditing
    ... Enable auditing of account management will log the creation and changes to ... You can audit Directory Service access to audit OU's. ... This security setting determines whether to audit each event of account ... For specific instructions about how to configure auditing policy settings, ...
    (microsoft.public.win2000.active_directory)
  • Re: Autoexec.nt file missing?
    ... you can't enable Auditing on a computer running Home Edition. ... You must specify what to audit. ... > example, a file, folder, registry key, printer, and so forth-that has its ...
    (microsoft.public.windowsxp.newusers)
  • Re: Auditing Privilege Use - failure only but still get Success
    ... Success only (applies to remote access, ... Audit account management: No Auditing ... Audit privilege use: No Auditing ...
    (microsoft.public.win2000.group_policy)
  • RE: Disable Logon/Logoff auditing for the SYSTEM account
    ... there is no such group policy that can be defined ... to only audit user accounts' logon and logoff. ... Failure for all user accounts including system account. ... This newsgroup only focuses on SBS technical issues. ...
    (microsoft.public.windows.server.sbs)