Re: Failed logon during reboot

From: Dave Weeden (dave_at_nospam.com)
Date: 02/10/05


Date: Thu, 10 Feb 2005 12:53:43 -0800

bump

"Dave Weeden" <dave@nospam.com> wrote in message
news:%23vwrgelDFHA.960@TK2MSFTNGP09.phx.gbl...
> Further to this, the 'Logon process' is advapi
>
> Screenshot attached.
>
> "Dave Weeden" <dave@nospam.com> wrote in message
> news:u9$70YlDFHA.4020@TK2MSFTNGP14.phx.gbl...
>> Hi all,
>>
>> Everytime I reboot my web server (Windows Server 2003), I get a strange
>> event 529 (Logon/Logoff) in mySecurity event log.
>>
>> The message is 'Unknown user name or bad password'.
>>
>> The user name is 'Secret' . I've never created an account with this name
>> and I'm pretty sure I haven't been hacked.
>>
>> Could it have something to do with my TrendMicro OfficeScan client?
>> Something more nefarious?
>>
>> TIA,
>>
>> Dave
>>
>>
>
>
>



Relevant Pages

  • Re: Failed logon during reboot
    ... the 'Logon process' is advapi ... Screenshot attached. ... > The message is 'Unknown user name or bad password'. ...
    (microsoft.public.windows.server.security)
  • Re: Strange Windows logon attempts
    ... >and the logon process was advapi. ... >This server is an Exchange server with port 25 accessible from the ... Can anyone access the advapi over port ...
    (Incidents)
  • Re: NetDevil - ADVAPI
    ... > | The login names are random, and the attempting logon process is call ADVAPI. ... > | network showed nothing open on these ports. ... Every reference with a Google search for ADVAPI came up with the Netdevil ... A subsequent Technet search found one hit - apparently ADVAPI is a ...
    (microsoft.public.security.virus)