Re: Lots of 529 events

From: Leif Pedersen [MVP] (leif.pedersenNOSPAM_at_get2net.dk)
Date: 12/09/04 

Date: Thu, 9 Dec 2004 21:53:38 +0100

Hi,

This might help:
http://www.eventid.net/display.asp?eventid=529&eventno=1&source=Security&phase=1

Leif

"John" <John@discussions.microsoft.com> skrev i en meddelelse
news:E06D69D4-AAF5-48D8-A5E2-1917589EEFBF@microsoft.com...
> I am running windows 2000 sp4, and exchange 2000 sp3 + rollup. I get lots
of
> event 529 that indiacte an unknown username or password. What are all
these??
> Many others also...Examples:
> Logon Failure:
> Reason: Unknown user name or bad password
> User Name: FTFSERVER$
> Domain: FTF
> Logon Type: 3
> Logon Process: NtLmSsp
> Authentication Package: NTLM
> Workstation Name: FTFSERVER
>
> Logon Failure:
> Reason: Unknown user name or bad password
> User Name: webmaster
> Domain: XXL-DAK57R7PQPX
> Logon Type: 3
> Logon Process: NtLmSsp
> Authentication Package: NTLM
> Workstation Name: XXL-DAK57R7PQPX
>
> Logon Failure:
> Reason: Unknown user name or bad password
> User Name: TsInternetUser
> Domain: GDF
> Logon Type: 3
> Logon Process: NtLmSsp
> Authentication Package: NTLM
> Workstation Name: GDF
>
> Logon Failure:
> Reason: Unknown user name or bad password
> User Name: webmaster
> Domain: GDF
> Logon Type: 3
> Logon Process: NtLmSsp
> Authentication Package: NTLM
> Workstation Name: GDF
>
> Logon Failure:
> Reason: Unknown user name or bad password
> User Name: Internet
> Domain: CORCORAN-2U79PS
> Logon Type: 3
> Logon Process: NtLmSsp
> Authentication Package: NTLM
> Workstation Name: CORCORAN-2U79PS

Relevant Pages

  • Re: Authentication failures
    ... Reason: Unknown user name or bad password ... Logon Failure: ... Caller User Name: - ...
    (microsoft.public.windows.server.sbs)
  • 824 times logon failure in the SBS server security log.
    ... Yesterday I got error messages on the server in the security log, ... Logon failure: ... Unknown user name or bad password ... Logon Type:3 ...
    (microsoft.public.windows.server.sbs)
  • Re: Security log in Event Viewer shows Failure Audits from other pcs????
    ... The error code was: 3221225572 ... Logon Failure: ... Unknown user name or bad password ...
    (microsoft.public.win2000.security)
  • Failed Logins
    ... Over the last week I have noticed several failed attemped logins using ... usernames such as webmaster, demo, install and similar ones. ... Logon Failure: ... Unknown user name or bad password ...
    (microsoft.public.inetserver.iis)
  • Re: LDAP Authentication
    ... Logon failure: unknown user name or bad password. ... If I put in the login name it does not work. ... > Mark Schupp ...
    (microsoft.public.inetserver.iis.security)