Failure Audits 529 & 680: How to track the IP address?

From: Juerg Reimann (jr_at_jworld.ch)
Date: 07/13/05 

Date: Wed, 13 Jul 2005 21:48:58 +0200

*** I'm not quite sure in what NS this post fits best, so I set a
followup-to: microsoft.public.security ***

I get quite a lot of 529 and 680 Failure Audits in the Security Log of the
Event Viewer. Some folks try (probably mistakenly, hopefully) to get into my
computer (yes, it's not behind a fw at the moment). So I want to track down
those Failure Audits with IP addresses of the hosts that cause them.

Does anybody know a (maybe freeware) solution to achieve something like
that? (Note: I'm talking about future events, it's clear that past ones
cannot be resolvet to IPs anymore.)

As always, any help would be much appreciated!

Cheers, Juerg 

-- 
It's time to tune in: http://jradio.ch/

Relevant Pages

  • Failure Audits 529 & 680: How to track the IP address?
    ... *** I'm not quite sure in what NS this post fits best, ... followup-to: microsoft.public.security *** ... I get quite a lot of 529 and 680 Failure Audits in the Security Log of the ... Event Viewer. ...
    (microsoft.public.security)
  • Failure Audits 529 & 680: How to track the IP address?
    ... *** I'm not quite sure in what NS this post fits best, ... followup-to: microsoft.public.security *** ... I get quite a lot of 529 and 680 Failure Audits in the Security Log of the ... Event Viewer. ...
    (microsoft.public.platformsdk.security)
  • Whats happening??
    ... My 2 servers are getting slammed with failure audits. ... security log in event viewer and then refresh and there are already 400 ... Each time I refresh there are more and more. ...
    (microsoft.public.windows.server.networking)
  • Re: OWA - Error Access Denied
    ... "Douglas Franklin" wrote in ... > Nothing listed under the Event Viewer - Security, no failure audits. ...
    (microsoft.public.exchange.connectivity)