Re: Authentication failures

When you checked was the user account locked out? Can they log onto another
machine? Has the user recently change their password? Perhaps they were
still logged in elswhere when they did?


"Mike Bannister" <mbannist@xxxxxxxxx (donotspam)> wrote in message
news:34730CED-376D-4DAD-98BA-EFAFEE538045@xxxxxxxxxxxxxxxx
I wish it were that obvious and easy. Of course I have checked the user
account. The user logs in every day. The bulk of the events are occuring
during off hours when the user is not present?


--
Mike Bannister


"Mike Bannister" wrote:

I am running SBS 2003 Sp1 with all XP pro clients. One of the clients has
suddenly started causing security event 529 as well as a netlogon failure
event 5722. I have tried deleting machine from domain and rejoining and
it
did not solve issueThe logs shows the following:

Source Event ID Last Occurrence Total
Occurrences
Security 529 2/3/2006 5:23 AM 26 *
Logon Failure:
Reason: Unknown user name or bad password
User Name: JeanHinsley
Domain: BCCIPDC
Logon Type: 3
Logon Process: NtLmSsp
Authentication Package: NTLM
Workstation Name: BCCIJHINSLEY
Caller User Name: -
Caller Domain: -
Caller Logon ID: -
Caller Process ID: -
Transited Services: -
Source Network Address: 192.168.0.33
Source Port: 3391


Source Event ID Last Occurrence Total Occurrences
NETLOGON 5722 2/3/2006 4:25 AM 6 *

The session setup from the computer BCCIJHINSLEY failed to authenticate.
The
name(s) of the account(s) referenced in the security database is
BCCIJHINSLEY$. The following error occurred: Access is denied.

Thanks in advance for your help...

--
Mike Bannister


.

Relevant Pages

  • Re: Login Errors Seem to indicate we are being hacked?
    ... wired LAN and I was wondering if the logins were coming through that. ... Switch on SMTP logging and in the logs you will find the IP to block if you ... Logon Failure: ... Caller User Name: SERVER01$ ...
    (microsoft.public.windows.server.sbs)
  • Re: How to ascertain what failed logins is caused by
    ... This is an attempt on your email / port 25 system, ... Switch on SMTP logging and in the logs you will find the IP to block if you ... Logon Failure: ... Caller User Name: SERVER01$ ...
    (microsoft.public.windows.server.sbs)
  • Re: How to ascertain what failed logins is caused by
    ... wired LAN and I was wondering if the logins were coming through that. ... Switch on SMTP logging and in the logs you will find the IP to block if you ... Logon Failure: ... Caller User Name: SERVER01$ ...
    (microsoft.public.windows.server.sbs)
  • Re: Login Errors Seem to indicate we are being hacked?
    ... Switch on SMTP logging and in the logs you will find the IP to block if you ... Logon Failure: ... Caller User Name: SERVER01$ ...
    (microsoft.public.windows.server.sbs)
  • RE: Authentication failures
    ... "Mike Bannister" wrote: ... Logon Failure: ... Caller User Name: - ... The session setup from the computer BCCIJHINSLEY failed to authenticate. ...
    (microsoft.public.windows.server.sbs)
Loading