event id 529 logon type 3 - lots of them

From: Gary Massengale (garym_jnospam_at_hotmail.com)
Date: 04/26/05 

Date: Tue, 26 Apr 2005 13:34:43 -0400

I saw a ton of these, all early this morning, during a short period of time,
before most users are even in the office.

is there any way I can find out where this is coming from? what
workstation or if it is over the internet?

Event Type: Failure Audit

Event Source: Security

Event Category: Logon/Logoff

Event ID: 529

Date: 4/26/2005

Time: 6:44:06 AM

User: NT AUTHORITY\SYSTEM

Computer: myserver

Description:

Logon Failure:

                Reason: Unknown user name or bad password

                User Name: connect

                Domain:

                Logon Type: 3

                Logon Process: Advapi

                Authentication Package:
MICROSOFT_AUTHENTICATION_PACKAGE_V1_0

                Workstation Name: myserver

Relevant Pages

  • Re: DCOM Errors in Event Logs.
    ... Here are the enents logged on the workstation. ... Event Type: Failure Audit ... Event Source: Security ... An error occurred during logon ...
    (microsoft.public.windows.server.sbs)
  • Re: Date/Time issue preventing logon
    ... Do you know why the workstation isn't synching its time with ... the server? ... When you start the workstation, ... Event Source: W32Time ...
    (microsoft.public.windows.server.sbs)
  • Re: Time Server Sync
    ... when the workstation starts (and at other times if you don't generally ... it should log the following event in the System log: ... Event Source: W32Time ... > How do I make the SBS2003 server the Time Server for all ...
    (microsoft.public.windows.server.sbs)
  • after SP2 snort reports this every few minutes
    ... Event Source: snort ... is my workstation, and .15 is my domain controller. ...
    (microsoft.public.windowsxp.security_admin)