Re: Security log in Event Viewer shows Failure Audits from other pcs????

OK. Here is what is happening. These events ...

1) The logon to account: john
by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
from workstation: HP-DV9608
failed. The error code was: 3221225572

2) Logon Failure:
Reason: Unknown user name or bad password
User Name: john
Domain: HP-DV9608
Logon Type: 3
Logon Process: NtLmSsp
Authentication Package: NTLM
Workstation Name: HP-DV9608

....were logged in another computers Event Viewer.

Thanks.



"Roger Abell [MVP]" <mvpNoSpam@xxxxxxx> wrote in message
news:%239mFQnFrIHA.3508@xxxxxxxxxxxxxxxxxxxxxxx
"Saucer Man" <saucerman@xxxxxxxxxx> wrote in message
news:4818607c$0$19824$cc2e38e6@xxxxxxxxxxxxxxxxx
I noticed on one of my Windows 2000 workstations that the Security log in
Event Viewer is showing Failure Audits from another PC. The other PC is a
Windows XP workstation. The failure audits are ID 681 and 529. These are
logon type errors. Why is it logging on someone elses PC?

--
Thanks!

Are you sure you are not misreading the event message?
Is it not telling you the workstation from which a network login
was originated, but the failed login was recorded on the machine
where the failed login was attempted ?
If not, then please post and example of these so that we can
see what you are seeing instead of just hearing how you are
understanding it.

Roger




.

Relevant Pages

  • Re: Lots of 529 events
    ... > Logon Failure: ... Unknown user name or bad password ... > Authentication Package: NTLM ...
    (microsoft.public.exchange2000.win2000)
  • Re: Implementing OWA 5.5
    ... Event Type: Warning ... The server was unable to logon the Windows NT account 'accountname' due to ... The data is the error code. ... I really want to publish this their mailbox thru OWA ...
    (microsoft.public.exchange.design)
  • Re: Implementing OWA 5.5
    ... Event Type: Warning ... The server was unable to logon the Windows NT account 'accountname' due to ... The data is the error code. ... I really want to publish this their mailbox thru OWA ...
    (microsoft.public.exchange.setup)
  • Re: Implementing OWA 5.5
    ... Event Type: Warning ... The server was unable to logon the Windows NT account 'accountname' due to ... The data is the error code. ... I really want to publish this their mailbox thru OWA ...
    (microsoft.public.exchange.admin)
  • 824 times logon failure in the SBS server security log.
    ... Yesterday I got error messages on the server in the security log, ... Logon failure: ... Unknown user name or bad password ... Logon Type:3 ...
    (microsoft.public.windows.server.sbs)