824 times logon failure in the SBS server security log.
From: jessica (jessica_at_discussions.microsoft.com)
Date: 10/27/04
- Next message: Michael Patrick: "RE: BACKUP"
- Previous message: Michael Patrick: "RE: New to SBS 2003 and really struggling"
- Next in thread: Michael Patrick: "RE: 824 times logon failure in the SBS server security log."
- Reply: Michael Patrick: "RE: 824 times logon failure in the SBS server security log."
- Messages sorted by: [ date ] [ thread ]
Date: Wed, 27 Oct 2004 09:03:07 -0700
Yesterday I got error messages on the server in the security log,
-----------------------------------------------------------------------
Total Occurrences: 824
Logon failure:
Reason: Unknown user name or bad password
UserName: Ken
...
Logon Type:3
Logon Process: NtLmSsp
Authentication packages: NTLM
.....
And corresponding in the event log:
Type Source Category Event User ....
Failure Audit ... Security Logon/Logoff 529 System
-------------------------------------------------------------------
Actually I check with user, the only difference he did yesterday is only use
his laptop to access our wireless network workgroup. And I did not configure
his laptop to have access to this file server, and he did not try to access
this file server.
My question is what is "NtLmSsp" service? Is this service is a automatically
service starting by XP(user's OS) and how come it failed the logon process
for 824 times? Looks like this process keep trying to logon the SBS server
itself without user's operation.
Any comments or help, thanks.
- Next message: Michael Patrick: "RE: BACKUP"
- Previous message: Michael Patrick: "RE: New to SBS 2003 and really struggling"
- Next in thread: Michael Patrick: "RE: 824 times logon failure in the SBS server security log."
- Reply: Michael Patrick: "RE: 824 times logon failure in the SBS server security log."
- Messages sorted by: [ date ] [ thread ]
Relevant Pages
|
