Re: Frequent event 529 in Securit
- From: v-chayan@xxxxxxxxxxxxxxxxxxxx ("Charles Yang [MSFT]")
- Date: Mon, 01 Aug 2005 00:24:26 GMT
Hi Bryan,
Thanks for updates.
I will reply you when you have time to reply, take care with your job.
Thanks for your effort:
--------------------
| From: "Bryan L" <blinton.nospam@xxxxxxxxxxxxxxxxxxxxxxxxxxx>
| References: <#y#cjbSkFHA.4000@xxxxxxxxxxxxxxxxxxxx>
| Subject: Re: Frequent event 529 in Securit
| Date: Fri, 29 Jul 2005 15:41:00 -0500
| Lines: 97
| X-Priority: 3
| X-MSMail-Priority: Normal
| X-Newsreader: Microsoft Outlook Express 6.00.2900.2180
| X-RFC2646: Format=Flowed; Response
| X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2180
| Message-ID: <#5iAW3HlFHA.2764@xxxxxxxxxxxxxxxxxxxx>
| Newsgroups:
microsoft.public.windows.server.networking,microsoft.public.windows.server.s
bs
| NNTP-Posting-Host: connellinsurance.com 66.76.216.32
| Path: TK2MSFTNGXA01.phx.gbl!TK2MSFTNGP08.phx.gbl!TK2MSFTNGP10.phx.gbl
| Xref: TK2MSFTNGXA01.phx.gbl microsoft.public.windows.server.sbs:139958
microsoft.public.windows.server.networking:18106
| X-Tomcat-NG: microsoft.public.windows.server.sbs
|
| Thanks for all posts and help on this. I have not resolved this issue,
but
| this week has been very busy and I have not had time to work on it. I
hope
| to have more time next week, and will post more then.
|
| Thanks again,
|
| Bryan
|
|
| "Bryan L" <blinton.nospam@xxxxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
| news:%23y%23cjbSkFHA.4000@xxxxxxxxxxxxxxxxxxxxxxx
| > I'm running a SBS 2003 domain with about 30 users. I promoted another
| > 2003 server std box to be a replica DC about a month ago. I've had the
| > luxury of time to work out the bugs and kinks getting this new DC to be
| > error-free and I'm almost done. The only persistent error I'm still
| > getting is the above-mentioned ID 529; a sample is provided below:
| > __________________________
| >
| > Event Type: Failure Audit
| > Event Source: Security
| > Event Category: Logon/Logoff
| > Event ID: 529
| > Date: 7/22/2005
| > Time: 4:28:07 PM
| > User: NT AUTHORITY\SYSTEM
| > Computer: SERVERNAME-2
| > Description:
| > Logon Failure:
| > Reason: Unknown user name or bad password
| > User Name:
| > Domain:
| > Logon Type: 3
| > Logon Process: Kerberos
| > Authentication Package: Kerberos
| > Workstation Name: -
| > Caller User Name: -
| > Caller Domain: -
| > Caller Logon ID: -
| > Caller Process ID: -
| > Transited Services: -
| > Source Network Address: 192.168.168.229
| > Source Port: 0
| > __________________________
| >
| > Services my network runs:
| > Exchange 2003
| > DFS/FRS
| > WINS
| > DNS
| > DHCP
| >
| > More information:
| >
| > - All clients are running XP SP2.
| > - These errors always appear in multiples of 4.
| > - Sometimes only 4 or 8 of these appear at a time for a given source
IP;
| > other times there are 20 or so, and now and then there are literally
| > thousands of them within the span of a few minutes, or even hundreds
| > within a handful of seconds.
| > - The most common source IP is a particular member server, but the
source
| > IP varies to include clients as well, both desktops and laptops.
| > - I believe it's a configuration problem and not malicious, since even
my
| > own workstation is sometimes the source IP.
| > - When coming from desktops the source port appears to always be 0,
but
| > when coming from the particular server that is most commonly the source
| > IP, the port increments by 3 every two events. For example, recently
a
| > total of 16 events were logged with this server as the source, all
within
| > the same second, and the ports looked like this: 3850, 3850, 3853,
3853,
| > 3856, 3856, 3859, 3859, 3862, 3862, 3865, 3865, 3868, 3868, 3871, 3871.
| > - These errors are being logged only on the new DC's security log; the
| > logs on my original SBS 2003 DC are clean.
| > - This server used to run 2000 Server with a static IP; it was wiped
and
| > cleanly installed with Server 2003 SP1 and set to the same static IP as
| > before.
| > - This server has a different name than the 2000 Server installation
| > did.
| > - A few days after the install, a gigabit NIC was installed in the
| > server and the onboard 10/100 NIC was disabled.
| > - DFS/FRS was in use for a short time on the 2000 Server, as a means
to
| > migrate the shares it was hosting to a different location prior to the
| > wipe and reinstall. The 2000 Server was never a DC.
| > - I believe I made a mistake in managing my DFS: I disabled DFS
referrals
| > to the old 2000 Server, but never actually removed all references to
the
| > server from DFS altogether before taking the old server permanently
| > offline. I'm about to look for information that will help me clean this
| > up; I've seen it out there in my readings on DFS. The "new" Server
2003
| > installation is not yet hosting its original shares again, but it has
been
| > set up as a DFS root replica.
| >
| > Any help appreciated; I'm not sure how to run this one down.
| >
| > Thanks in advance,
| >
| > Bryan
| >
|
|
|
Best regards,
Charles Yang (MSFT)
Microsoft CSS Online Newsgroup Support
Get Secure! - www.microsoft.com/security
======================================================
This newsgroup only focuses on SBS technical issues. If you have issues
regarding other Microsoft products, you'd better post in the corresponding
newsgroups so that they can be resolved in an efficient and timely manner.
You can locate the newsgroup here:
http://www.microsoft.com/communities/newsgroups/en-us/default.aspx
When opening a new thread via the web interface, we recommend you check the
"Notify me of replies" box to receive e-mail notifications when there are
any updates in your thread. When responding to posts via your newsreader,
please "Reply to Group" so that others may learn and benefit from your
issue.
Microsoft engineers can only focus on one issue per thread. Although we
provide other information for your reference, we recommend you post
different incidents in different threads to keep the thread clean. In doing
so, it will ensure your issues are resolved in a timely manner.
For urgent issues, you may want to contact Microsoft CSS directly. Please
check http://support.microsoft.com for regional support phone numbers.
Any input or comments in this thread are highly appreciated.
======================================================
This posting is provided "AS IS" with no warranties, and confers no rights.
=====================================================
When responding to posts, please "Reply to Group" via your newsreader so
that others may learn and benefit from your issue.
=====================================================
This posting is provided "AS IS" with no warranties, and confers no rights.
.
- Follow-Ups:
- Re: Frequent event 529 in Securit
- From: Bryan L
- Re: Frequent event 529 in Securit
- Prev by Date: RE: Streaming audio creating problems.
- Next by Date: Re: Exchange Server ActiveSync HTTP_403
- Previous by thread: RE: Streaming audio creating problems.
- Next by thread: Re: Frequent event 529 in Securit
- Index(es):
Relevant Pages
|
