Event id 529
- From: THI_IB <myself@xxxxxxxxxx>
- Date: Tue, 10 Jul 2007 12:50:03 -0700
Hello to All:
Problem:
No domain controllers, just windows xp machines in a workgroup connected to
the Internet behind a secure DMZ, firewall, and proxy server. I have listed
just a couple of the machines in the workgroup, but there are about half a
dozen more in the workgroup that show up in the event log with event id 529
as the shown below.
I setup a brand new pc right out the box and as you can guess a day later it
shows up in my security logs (event id 529). All pc's including mine are xp
boxes.
This occurs on a daily basis, at least 7 or 8 times a day with different
pc's in the workgroup. It is not causing a problem, but from a technical
view I would like to know why this is happening.
Virus def's are set to update 3 times a day. Virus scans are done once in
the morning and once in the evening. Windows updates are applied on a
regular basis.
I have been over my system with a fine tooth comb and found nothing. I have
read several threads from a google search that are experiencing the same
problem, but no solid solution. Of course every network is different. Only
common denominator is Microsoft OS (xp, w2k, etc etc)
As one of the network admins here with the company and 10 years in the
network support field (MCSE, A+ certified, CCNA) I'm pretty sure I do not
have an application installed that says hey come and logon to my pc why don't
ya.
My fellow techies of the world, am I missing something here? Thanks
1.) Event Type: Failure Audit
Event Source: Security
Event Category: Logon/Logoff
Event ID: 529
Date: 7/10/2007
Time: 1:40:25 PM
User: NT AUTHORITY\SYSTEM
Computer: HMORRISPC
Description:
Logon Failure:
Reason: Unknown user name or bad password
User Name: jbauch
Domain: JBAUCHPCC
Logon Type: 3
Logon Process: NtLmSsp
Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Workstation Name: JBAUCHPCC
For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
------------------------------------------------------------------------------------------
2.)
Event Type: Failure Audit
Event Source: Security
Event Category: Logon/Logoff
Event ID: 529
Date: 7/9/2007
Time: 4:48:48 PM
User: NT AUTHORITY\SYSTEM
Computer: HMORRISPC
Description:
Logon Failure:
Reason: Unknown user name or bad password
User Name: Emily
Domain: EMISRACHPC
Logon Type: 3
Logon Process: NtLmSsp
Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Workstation Name: EMISRACHPC
For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
--
Harv-man
Network Support
.
- Follow-Ups:
- Re: Event id 529
- From: Jose
- Re: Event id 529
- Prev by Date: trustedsource.org
- Next by Date: Re: [help] too many processes shown in Windows Task Manager when startup.
- Previous by thread: trustedsource.org
- Next by thread: Re: Event id 529
- Index(es):
Relevant Pages
|
