RE: Critical Errors in Security Log

Tech-Archive recommends: Fix windows errors by optimizing your registry

From: dvw (dvw_at_discussions.microsoft.com)
Date: 03/16/05 

Date: Wed, 16 Mar 2005 12:59:06 -0800

Steve, see a similar post on 3/12/2005 8:27am PST for a likely explanation.
The short answer is be sure you're using strong passwords.

"Steve Novak" wrote:

> I run SBS2003 on a small network serving only two users. Recently I have
> been receiving notice in the daily Performance Report of errors in the
> Security Log. The errors are reported as follows:
>
> Event Type: Failure Audit
> Event Source: Security
> Event Category: Logon/Logoff
> Event ID: 529
> Date: 3/15/2005
> Time: 9:57:34 AM
> User: NT AUTHORITY\SYSTEM
> Computer: NS2
> Description:
> Logon Failure:
> Reason: Unknown user name or bad password
> User Name: connect
> Domain:
> Logon Type: 3
> Logon Process: Advapi
> Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
> Workstation Name: NS2
> Caller User Name: NS2$
> Caller Domain: NOVAKS
> Caller Logon ID: (0x0,0x3E7)
> Caller Process ID: 772
> Transited Services: -
> Source Network Address: -
> Source Port: -
>
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
>
>
> Can anyone tell me where these are comming from and what steps I might take
> to insure the security of my network?
>
>
>

Relevant Pages

  • Re: ID-ing Hackers
    ... Logon Process: Advapi ... Caller User Name: SERVER$ ... The level of awareness of security issues of most computer users is on a par with their knowledge of quantum mechanics. ... If the remote users are managers, and therefore immune to sticks, reason and suchlike, at least tell them in writing that the security of the network depends on the quality of their passwords. ...
    (microsoft.public.windows.server.sbs)
  • Re: SBS SP2 w/ISA Error 529
    ... Can anybody tell me how they are able to GET to the ports they are trying? ... or ensure you at least have impossibly hard to crack passwords. ... How is it possible that the attacker is allowed to attempt to logon ... Caller User Name: MOBILE01$ ...
    (microsoft.public.windows.server.sbs)
  • Re: Logon Failure message
    ... Be sure you have strong passwords and the current ... > Logon Type: 3 ... > Caller User Name: SERVER1$ ...
    (microsoft.public.windows.server.sbs)
  • Re: Is someone trying to hack me?
    ... passwords in place. ... > Logon Failure: ... > Logon Process: Advapi ... > Caller User Name: XYZBSVR$ ...
    (microsoft.public.windows.server.sbs)
  • Re: KDC Event ID 7 and Wins startup errors.
    ... Event Type: Information ... Event Source: USER32 ... Logon Failure: ... Caller User Name: $ ...
    (microsoft.public.windows.server.sbs)