Re: Security Log Event ID 529 - Old Administrator account name
- From: "Michael Jenkin [SBS-MVP]" <michael.jenkin@xxxxxxxx>
- Date: Sun, 25 Sep 2005 10:00:04 +0900
Are any of your services trying to start with the old credentials ?
Todd wrote:
> I have been getting event ID 529 in the Security Log of our SBS 2003 (no SP1)
> box for some time. The event occurs maybe once or twice per day. The user
> name referenced in the event is the old name of the default administrator
> account. A few months ago, the name of the administrator account was
> changed, but a few days later it was changed back to its original name. How
> do I determine what process or service is trying to authenticate using the
> old administrator account name?
>
> Event Type: Failure Audit
> Event Source: Security
> Event Category: Logon/Logoff
> Event ID: 529
> Date: 9/23/2005
> Time: 10:07:27 PM
> User: NT AUTHORITY\SYSTEM
> Computer: SBS Computer
> Description:
> Logon Failure:
> Reason: Unknown user name or bad password
> User Name: Old Domain Acct Name
> Domain: DOMAIN
> Logon Type: 3
> Logon Process: NtLmSsp
> Authentication Package: NTLM
> Workstation Name: SBS Computer
> Caller User Name: -
> Caller Domain: -
> Caller Logon ID: -
> Caller Process ID: -
> Transited Services: -
> Source Network Address: -
> Source Port: -
>
> Thanks,
>
> Todd
--
Michael J. Jenkin MVP - SBS, Senior Systems Engineer
Visit http://www.mickyj.com
Microsoft Most Valued Professional, Microsoft's Windows Server Systems -
Small Business Server
MVP's do not work for Microsoft. If this email was generated in a
newsgroup, please reply only to the newsgroup.
Note: The contents of my postings and responses here represent my
personal opinions and do not necessarily reflect the views, thoughts or
feelings of Microsoft or any of its employees.
http://mvp.support.microsoft.com
.
- Prev by Date: Re: The Local Policy of the system does not permit you to Log on Inter
- Next by Date: Re: Security Log Event ID 529 - Old Administrator account name
- Previous by thread: Re: The Local Policy of the system does not permit you to Log on Inter
- Next by thread: Re: Security Log Event ID 529 - Old Administrator account name
- Index(es):
Relevant Pages
|
Loading
