unknown user name / dropping authentication

Tech-Archive recommends: Repair Windows Errors & Optimize Windows Performance

Hello,
my SBS2003 standard is running a small set of 5 desktop machines. At first,
about 8 weeks ago, I noticed that
the clients drop their authentication to the server with or without warning
message. if there is a warning message, it talkes about possibly compromised
security. The only way to reconnect to the server is logoff/logon or reboot.
I found in the local User Profils (My Computer, Properties, Advanced, User
Profiles) something called User Unknown as a profile on all the machines,
which I deleted. The server also reported in its security event viewer a
bunch of failed logons from these clients with User Unknown or Bad Password.

All machines are running XP Pro, autoupdates on, and Trend Micro. I have not
yet found a real pattern of sorts. Below is a copy of one of the event
viewer entires. There is anywhere from 10 to 50 per day.
thanks!
Peter


Event Type: Failure Audit
Event Source: Security
Event Category: Logon/Logoff
Event ID: 529
Date: 4/5/2005
Time: 8:02:23 AM
User: NT AUTHORITY\SYSTEM
Computer: SERVER
Description:
Logon Failure:
Reason: Unknown user name or bad password
User Name:
Domain: MELISSA
Logon Type: 3
Logon Process: NtLmSsp
Authentication Package: NTLM
Workstation Name: MELISSA
Caller User Name: -
Caller Domain: -
Caller Logon ID: -
Caller Process ID: -
Transited Services: -
Source Network Address: 192.168.1.105
Source Port: 1428


For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.


.

Relevant Pages

  • Re: ISA SERVER NOT STARTING
    ... I delete the nat/basic firewall and stop and started the RRAS an tried to ... There were no critical events in the DNS Server Log in the last 24 hours. ... An error occurred during logon ... Caller User Name: - ...
    (microsoft.public.windows.server.sbs)
  • Re: Event ID 529
    ... First is a hardware firewall that sits on the perimeter of your network and requires that your users give user names and passwords, different from those for the network. ... Sometimes the Logon Type is different, also the User Name can be ... Computer: <SERVER NAME> ... Caller User Name: $ ...
    (microsoft.public.windows.server.sbs)
  • Re: Another security question/issue.
    ... Time to audit your server and workstations with AV, Malware, and installed ... Logon Process: Advapi ... Caller User Name: servername$ ... Source Port: - ...
    (microsoft.public.windows.server.sbs)
  • Re: Logon 529 Errors
    ... Default SMTP Virtual Server properties-Access tab-Relay ... Connection filtering is different from what inna is attempting, ... These are almost surely SMTP logon attempts, ... Caller User Name: DELLSERVER$ ...
    (microsoft.public.windows.server.sbs)
  • Re: Logon 529 Errors
    ... connection has been found on the black list, my DNS server ... Connection filtering is different from what inna is attempting, ... These are almost surely SMTP logon attempts, ... Caller User Name: DELLSERVER$ ...
    (microsoft.public.windows.server.sbs)