empty fields in event 534

Hello,
W2k3 server, ee.
Does anyone have idea what is cause of empty "source network address" and
"source port" fields in such security event?:

2005-10-04,17:16:35,Security,Failure Audit,Logon/Logoff ,534,NT
AUTHORITY\SYSTEM,R02,Logon Failure:

" Reason: The user has not been granted the requested"

" logon type at this machine"

" User Name: Steven"

" Domain: DOM"

" Logon Type: 2"

" Logon Process: Advapi "

" Authentication Package: Negotiate"

" Workstation Name: R02"

" Caller User Name: R02$"

" Caller Domain: DOM"

" Caller Logon ID: (0x0,0x3E7)"

" Caller Process ID: 1568"

" Transited Services: -"

" Source Network Address: -"

" Source Port: -"

The event is generated when user have no access to R02 server, but when user
is located in local subnet (with R02 server) these fields are populated with
IP address and port number, but when user seats behind router these fields
are empty. Any suggestions?


Regards,
Juzef



.

Relevant Pages

  • why empty source port address?
    ... " Logon Type: 2" ... " Caller User Name: R02$" ... The event is generated when user have no access to R02 server, ...
    (microsoft.public.win2000.general)
  • Re: Need to find out the IP of someone trying to hack a server
    ... I'm getting logon type 8, ... looking at the server event logs, ... Caller User Name: XXXXXXX$ ...
    (microsoft.public.isa)
  • Re: Another security question/issue.
    ... Time to audit your server and workstations with AV, Malware, and installed ... Logon Process: Advapi ... Caller User Name: servername$ ... Source Port: - ...
    (microsoft.public.windows.server.sbs)
  • Re: Event ID 529
    ... First is a hardware firewall that sits on the perimeter of your network and requires that your users give user names and passwords, different from those for the network. ... Sometimes the Logon Type is different, also the User Name can be ... Computer: <SERVER NAME> ... Caller User Name: $ ...
    (microsoft.public.windows.server.sbs)
  • Re: Logon 529 Errors
    ... connection has been found on the black list, my DNS server ... Connection filtering is different from what inna is attempting, ... These are almost surely SMTP logon attempts, ... Caller User Name: DELLSERVER$ ...
    (microsoft.public.windows.server.sbs)