Event Log - Security - Numerous Failures

From: David Secker (dsecker_at_lionfield_dot_com)
Date: 09/17/03 

Date: Wed, 17 Sep 2003 12:27:17 -0400

Hi all, I've referred to past posts in this group many times for help, but I
can't seem to find an answer for my latest problem no matter where I look.
    The problem is with a security log on a Windows 2000 Server. I get
failure audits every five minutes around the clock. They generally appear 4
in row with 2 matching sets.

First failure (and thrid) is:
Event Type: Failure Audit
Event Source: Security
Event Category: Account Logon
Event ID: 681
User: NT AUTHORITY\SYSTEM
Computer: <servername>
Description:
The logon to account: Administrator
 by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
 from workstation: <servername>
 failed. The error code was: 3221225578

Second (and fourth) is:
Event Type: Failure Audit
Event Source: Security
Event Category: Logon/Logoff
Event ID: 529
User: NT AUTHORITY\SYSTEM
Computer: <servername>
Description:
Logon Failure:
  Reason: Unknown user name or bad password
  User Name: Administrator
  Domain: <domain>
  Logon Type: 7
  Logon Process: Advapi
  Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
  Workstation Name: <servername>

I've checked all the services to make sure they are logging on properly and
they all seem to be. The only services that don't use the localsystem acct
are the Backup Exec 8 services, and they are also starting without a
problem.
    Is there any way I can further audit the logon attempts to see what
might be causing these? Anyone have a similar problem that they resolved?
Any help would be greatly appricated.

   Thanks,
   David Secker

Relevant Pages