Re: Unexplained Failed Logins

Local login does not allow happen only via the console/keyboard.
For a couple examples, IIRC with W2k a terminal services login is
a local login, or will all version of OS an authentication via Front
Page for web authoring is a local login (although the event log entries
you post would not fit the FrontPage pattern).
So, you may want to examine the external network exposures.

"James B" <JamesB@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:1B88238B-A7D8-4C05-98B7-60C1024B985C@xxxxxxxxxxxxxxxx
Hi,
While reviewing our system Security event log (Win2K SBS) I found 3
failed
login attempts that appear to have occurred at the server itself. The
problem
is that according to the alarm system log no one was in the building for
hours before or after the times of the failed logins.

The first one was at 1:53 am, the next at 2:19 am and the last at 2:33
am.
According to the info in the MS kb, 'logon type 2' is from the keyboard
and
not a network login, which would mean that it happened at my server.

Anyone have any ideas?

James

Event Type: Failure Audit
Event Source: Security
Event Category: Account Logon
Event ID: 676
Date: 1/17/2007
Time: 1:53:05 AM
User: NT AUTHORITY\SYSTEM
Computer: MAIN-SERVER
Description:
Authentication Ticket Request Failed:
User Name: test
Supplied Realm Name: NETWORKDOMAIN
Service Name: krbtgt/NETWORKDOMAIN
Ticket Options: 0x40810010
Failure Code: 0x6
Client Address: 127.0.0.1

Event Type: Failure Audit
Event Source: Security
Event Category: Logon/Logoff
Event ID: 529
Date: 1/17/2007
Time: 1:53:05 AM
User: NT AUTHORITY\SYSTEM
Computer: MAIN-SERVER
Description:
Logon Failure:
Reason: Unknown user name or bad password
User Name: test
Domain: NETWORKDOMAIN
Logon Type: 2
Logon Process: User32
Authentication Package: Negotiate
Workstation Name: MAIN-SERVER


.

Relevant Pages