Re: Password checking is running-please help

OK. Do you recognize and of the computer names? What is the server used for?
How long have these events been appearing in the log? I would double check
your firewall configuration to make sure that only needed services are
enabled and exposed to the network adapters. In a pinch you could use one of
the self scan sites to make sure that you do not have unneeded ports open
such as file and print sharing such as at --- http://scan.sygatetech.com/
.. Make sure file and print sharing is disabled on the external network
adapter. MBSA can help check for some vulnerabilities on your server if you
have not used it before. --- Steve

http://www.microsoft.com/technet/security/tools/mbsahome.mspx --- MBSA

"Spider" <Spider@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:BC7CBBD6-8B4C-4720-9399-08A813FF9FF8@xxxxxxxxxxxxxxxx
Hi Steve,

No, server is SA, on DMZ.

Sincerely yours,
Zeraldin

"Steven L Umbach" wrote:

Is the server a domain controller? If it is that might not be unusual if
there are domain clients using XP Pro that have not upgraded to SP2 and
the
user is logging on with a local computer account. The link below explains
more. If it is not a domain controller then you may have someone from
computer RM1043 trying to access the administrator account on your
server.
Do you recognize computer named RM1043 as being a computer on your
etwork? --- Steve

http://support.microsoft.com/default.aspx?scid=kb;en-us;811082

"Spider" <Spider@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:82D6B0D8-114C-4E11-97FB-B9BED2EABB4F@xxxxxxxxxxxxxxxx
Hi people,
I get lot of these on my Windows 2000 server:
Event Type: Failure Audit
Event Source: Security
Event Category: Logon/Logoff
Event ID: 529
Date: 2006-04-14
Time: 06:01:51
User: NT AUTHORITY\SYSTEM
Computer: OSTGOTA
Description:
Logon Failure:
Reason: Unknown user name or bad password
User Name: Admin
Domain: RM1043
Logon Type: 3
Logon Process: NtLmSsp
Authentication Package: NTLM
Workstation Name: RM1043

Any ideas guys, how to dig more about this. I get these almost every
minute.





.

Relevant Pages

  • Re: SBS2000 server generating DCOM errors and multiple security events.
    ... Can you post the ipconfig/all from the server and one from a client? ... > Event Type: Warning ... > Event Category: Account Logon ...
    (microsoft.public.backoffice.smallbiz2000)
  • security log events
    ... Event Type: Success Audit ... Event Source: Security ... Special privileges assigned to new logon: ... User Name: SERVER$ ...
    (microsoft.public.windows.server.general)
  • Re: Logon Server Unavailable
    ... There are currently no logon servers available to service ... You use a office laptop to connect the office VPN, when you map a network ... you may receive this message: "This account is the ... The server is not configured for transactions"> "A domain controller for your domain could not be contacted" ...
    (microsoft.public.windows.server.general)
  • Re: Logon Server Unavailable
    ... There are currently no logon servers available to service ... You use a office laptop to connect the office VPN, when you map a network ... you may receive this message: "This account is the ... The server is not configured for transactions"> "A domain controller for your domain could not be contacted" ...
    (microsoft.public.windows.server.dns)
  • Re: Logon Server Unavailable
    ... There are currently no logon servers available to service ... You use a office laptop to connect the office VPN, when you map a network ... you may receive this message: "This account is the ... The server is not configured for transactions"> "A domain controller for your domain could not be contacted" ...
    (microsoft.public.windows.server.networking)