Logon Error After Admin Passwd Change

From: D. Storme (ds_at_ds.org)
Date: 10/24/04 

Date: Sun, 24 Oct 2004 07:20:45 -0600

I changed the admin password on a SBS2003 Premium (SQL and ISA). After the
change I am seeing ~ 600 (every 24 hours) entries in the security log.
Groups of errors (~30) seem to occur during the first 2-3 minutes every
hour. The entries looks like:

Event Type: Failure Audit
Event Source: Security
Event Category: Logon/Logoff
Event ID: 529
Date: 10/24/2004
Time: 6:02:32 AM
User: NT AUTHORITY\SYSTEM
Computer: Server 1
Description:
Logon Failure:
  Reason: Unknown user name or bad password
  User Name: administrator
  Domain: sbs
  Logon Type: 3
  Logon Process: NtLmSsp
  Authentication Package: NTLM
  Workstation Name: Server 1
  Caller User Name: -
  Caller Domain: -
  Caller Logon ID: -
  Caller Process ID: -
  Transited Services: -
  Source Network Address: -
  Source Port: -

I did find one location in Trend Micro that used the old password and
changed it.

I did change the admin password through the Server Management UI.

Any ideas would be greatly appreciated.

TIA

Relevant Pages

  • Re: ISA SERVER NOT STARTING
    ... I delete the nat/basic firewall and stop and started the RRAS an tried to ... There were no critical events in the DNS Server Log in the last 24 hours. ... An error occurred during logon ... Caller User Name: - ...
    (microsoft.public.windows.server.sbs)
  • Re: Event ID 529
    ... First is a hardware firewall that sits on the perimeter of your network and requires that your users give user names and passwords, different from those for the network. ... Sometimes the Logon Type is different, also the User Name can be ... Computer: <SERVER NAME> ... Caller User Name: $ ...
    (microsoft.public.windows.server.sbs)
  • Re: Another security question/issue.
    ... Time to audit your server and workstations with AV, Malware, and installed ... Logon Process: Advapi ... Caller User Name: servername$ ... Source Port: - ...
    (microsoft.public.windows.server.sbs)
  • Re: Logon 529 Errors
    ... Default SMTP Virtual Server properties-Access tab-Relay ... Connection filtering is different from what inna is attempting, ... These are almost surely SMTP logon attempts, ... Caller User Name: DELLSERVER$ ...
    (microsoft.public.windows.server.sbs)
  • Re: Logon 529 Errors
    ... connection has been found on the black list, my DNS server ... Connection filtering is different from what inna is attempting, ... These are almost surely SMTP logon attempts, ... Caller User Name: DELLSERVER$ ...
    (microsoft.public.windows.server.sbs)