Re: Failure Audit

From: Derek Melber (derekm_at_braincore.net)
Date: 01/31/04 

Date: Sat, 31 Jan 2004 10:50:14 -0700

This sounds like a service account that is attempting to logon continuously,
or an application that is attempting to logon. Might want to check your
service accounts to see if a password is incorrect. 

-- 
Derek Melber
"RG" <nobody@nowhere.com> wrote in message
news:uxRD9wV5DHA.2168@TK2MSFTNGP12.phx.gbl...
> I am getting the following failure audit every 5 five minutes.   It
appears
> that somebody or something tried to login, but wasn't successful.  Would
> anyone know the typical cause for this? or where I could dig out more info
> so that I could identify the root of the problem?
>
> Event Type: Failure Audit
> Event Source: Security
> Event Category: Logon/Logoff
> Event ID: 537
> Date:  1/27/2004
> Time:  11:54:54 PM
> User:  NT AUTHORITY\SYSTEM
> Computer: INTERNAL
> Description:
> Logon Failure:
>   Reason:  An error occurred during logon
>   User Name:
>   Domain:
>   Logon Type: 3
>   Logon Process: Kerberos
>   Authentication Package: Kerberos
>   Workstation Name: -
>   Status code: 0xC000006A
>   Substatus code: 0x0
>   Caller User Name: -
>   Caller Domain: -
>   Caller Logon ID: -
>   Caller Process ID: -
>   Transited Services: -
>   Source Network Address: -
>   Source Port: -
>
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
>
> Thanks in advance
>
>

Relevant Pages

  • Re: Failure Audit in Security Logs
    ... Event Type: Failure Audit ... Logon Failure: ... Logon Process: NtLmSsp ... Caller User Name: - ...
    (microsoft.public.windows.server.sbs)
  • Re: Security Log Failure Audit
    ... Whenever an invalid logon occurs a "Failure Audit" event is written to the ... but the "Source Network Address" entry is always blank. ... Caller User Name: MyServer$ ...
    (microsoft.public.security)
  • Re: Failure Audit in Security Logs
    ... Event Type: Failure Audit ... Logon Failure: ... Logon Process: NtLmSsp ... Caller User Name: - ...
    (microsoft.public.windows.server.sbs)
  • Re: Unknown user name or bad password
    ... Event Type: Failure Audit ... Logon Failure: ... Caller User Name: - ...
    (microsoft.public.windows.server.sbs)
  • Event log error? Please help
    ... Event Type: Failure Audit ... Logon Failure: ... Caller User Name: - ...
    (microsoft.public.windows.server.sbs)
Quantcast