Re: Wrong domain in event log?

Thanks Les.

Actually you had pointed me to an eventid.net article which I had already
visited. But you correctly pointed out that I had to promote the user and
then log in with the users credentials to see the the problem under "user
accounts-->advanced-->manage passwords" The user was listed as
"servername\username" instead of "domainname\username". I think now that I
deleted the entry the 529 security events will disappear also.
Thanks again for your help!
--
Mike Bannister


"Les Connor [SBS Community Member - SBS M" wrote:

Hi Mike,

Nothing to worry about I think - ask JeanHinsley if he/she entered her
password incorreclty.

The failed login was from the workstation called BCCIJHINSLEY at IP address
192.168.0.3

--
Les Connor [SBS Community Member - SBS MVP]
-----------------------------------------------------------
SBS Rocks !
----------------------
"Tell me and I'll forget. Show me and I'll remember. Involve me and I'll
understand." - Confucius


"Mike Bannister" <mbannist@xxxxxxxxx (donotspam)> wrote in message
news:E136A15F-53F5-4A8A-8EE2-DC3B9974A6F2@xxxxxxxxxxxxxxxx
I noticed in my security event log I had a failed audit message with an
event
id of 529. The domain name is burnco yet the event log message reports it
as
bccipdc which is the name of the server? Anyone know what causes this and
how
to fix it? The machine referenced is a fully patched xp pro workstation
and I
am running SBS 2003 sp1.

Event Type: Failure Audit
Event Source: Security
Event Category: Logon/Logoff
Event ID: 529
Date: 2/6/2006
Time: 3:49:40 PM
User: NT AUTHORITY\SYSTEM
Computer: BCCIPDC
Description:
Logon Failure:
Reason: Unknown user name or bad password
User Name: JeanHinsley
Domain: BCCIPDC
Logon Type: 3
Logon Process: NtLmSsp
Authentication Package: NTLM
Workstation Name: BCCIJHINSLEY
Caller User Name: -
Caller Domain: -
Caller Logon ID: -
Caller Process ID: -
Transited Services: -
Source Network Address: 192.168.0.33
Source Port: 3279


For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

--
Mike Bannister



.

Relevant Pages

  • Re: Event ID 539 & 529 in large numbers - from what?
    ... When I get an account locking out without obvious cause, I just go in and delete all the saved passwords. ... Both the username and the workstation name are legitimate user/workstation on the network. ... Logon Failure: ... Caller User Name: - ...
    (microsoft.public.windows.server.sbs)
  • Re: Event ID 539 & 529 in large numbers - from what?
    ... Part of what I meant though, is that <username> could be the name of a user or the name of a machine, when a machine is connecting to the server to get group policies, for example. ... Both the username and the workstation name are legitimate user/workstation on the network. ... Logon Failure: ... Caller User Name: - ...
    (microsoft.public.windows.server.sbs)
  • Re: Stop illegal login attempts?
    ... How can I stop illegal login attempts to my SBS box Exchange server? ... I had a guy last night try for over 3 hours to guess my username/password which generated over 610 security errors in the security event log. ... Logon Failure: ... Caller User Name: WX98$ ...
    (microsoft.public.windows.server.sbs)
  • Event ID 539 & 529 in large numbers - from what?
    ... The only thing unique about this particular workstation ... Logon Failure: ... Logon Process: NtLmSsp ... Caller User Name: - ...
    (microsoft.public.windows.server.sbs)
  • Problems with 529 Events
    ... my security event log on my SBS 2003 SP1 box. ... Logon Failure: ... Workstation Name: MAILSERVER ... I do all of my port ...
    (microsoft.public.windows.server.sbs)