Re: Security log in Event Viewer shows Failure Audits from other pcs????

The problem is John on machine HP-DV9608 did not try to logon to the PC
where this was logged. John only logged onto machine HP-DV9608 which is
only part of a workgroup. When he does this, these events get logged into
this OTHER machine in the domain.


"Roger Abell [MVP]" <mvpNoSpam@xxxxxxx> wrote in message
news:%23blg5SRrIHA.4928@xxxxxxxxxxxxxxxxxxxxxxx
So, those messages are common, and are saying that
someone/something attempted to do a network login
(lgon type 3) as an account named john onto the machine
where this was recorded from a machine that was named
HP-DV9608 that was not in a domain (domain same as
workstation name)


"Saucer Man" <saucerman@xxxxxxxxxx> wrote in message
news:481b5ce3$0$19804$cc2e38e6@xxxxxxxxxxxxxxxxx
OK. Here is what is happening. These events ...

1) The logon to account: john
by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
from workstation: HP-DV9608
failed. The error code was: 3221225572

2) Logon Failure:
Reason: Unknown user name or bad password
User Name: john
Domain: HP-DV9608
Logon Type: 3
Logon Process: NtLmSsp
Authentication Package: NTLM
Workstation Name: HP-DV9608

...were logged in another computers Event Viewer.

Thanks.



"Roger Abell [MVP]" <mvpNoSpam@xxxxxxx> wrote in message
news:%239mFQnFrIHA.3508@xxxxxxxxxxxxxxxxxxxxxxx
"Saucer Man" <saucerman@xxxxxxxxxx> wrote in message
news:4818607c$0$19824$cc2e38e6@xxxxxxxxxxxxxxxxx
I noticed on one of my Windows 2000 workstations that the Security log
in Event Viewer is showing Failure Audits from another PC. The other PC
is a Windows XP workstation. The failure audits are ID 681 and 529.
These are logon type errors. Why is it logging on someone elses PC?

--
Thanks!

Are you sure you are not misreading the event message?
Is it not telling you the workstation from which a network login
was originated, but the failed login was recorded on the machine
where the failed login was attempted ?
If not, then please post and example of these so that we can
see what you are seeing instead of just hearing how you are
understanding it.

Roger









.

Relevant Pages

  • Re: Security log in Event Viewer shows Failure Audits from other pcs????
    ... as an account named john onto the machine ... john ... Logon Failure: ... Is it not telling you the workstation from which a network login ...
    (microsoft.public.win2000.security)
  • Re: Swapping email accounts
    ... mailbox from the AE logon account, and then reassociate it with a different ... >> since the person is John, he would get his own environment. ... >> I realize that I will need to deal with the Outlook profiles, ... > and the login - they may not get it. ...
    (microsoft.public.exchange2000.admin)
  • Re: Security log in Event Viewer shows Failure Audits from other pcs????
    ... Something John is doing, or that starts when he logs in, ... Logon Failure: ... Workstation Name: HP-DV9608 ... Is it not telling you the workstation from which a network login ...
    (microsoft.public.win2000.security)
  • Re: Security log in Event Viewer shows Failure Audits from other pcs????
    ... Something John is doing, or that starts when he logs in, ... Logon Failure: ... Is it not telling you the workstation from which a network login ... but the failed login was recorded on the machine ...
    (microsoft.public.win2000.security)
  • RE: URGENT - Domain Lockout
    ... John ... >> RDC from home to do some locking down with group policy. ... >> the LAN Manager Authentication Level in the DOMAIN policy while leaving much ... Needless to say, logon is failing. ...
    (microsoft.public.windows.server.active_directory)