Re: Another Event 529

Could be..

I tried W32TM /resync on a workstation and got "ther computer did not resync
because no time data was available"
I might have an issue with the SBS Time Service. I checked that it is
started, the firewall settings have not been altered recently.


"Maxibo" <totallyanon@xxxxxxxxx> wrote in message
news:erXw5NjaGHA.508@xxxxxxxxxxxxxxxxxxxxxxx
Hi Terry, I can only say that when I had these issues it was related to
time syncing... 2 pcs were not in sysnc with the server...


"Terry M" <terrym@xxxxxxxxxxxxxxxxxx> wrote in message
news:O$$taDiaGHA.1348@xxxxxxxxxxxxxxxxxxxxxxx
I have a fully patched SBS Prem box SP1 without ISA. I use Trend CSM, and
we
using a Symantec Corporate Firewall.

I am loging hundreds of NT AUTHORITY\SYSTEM Logon failures from my
workstations like seen below.

They generally come in groups of four, for the same workstation with
different Source Ports. All workstation seem to be getting triggering
the
same event with different Source Port #'s.

I recently did a hard drive upgrade and restored the Server from backup.
I
did my SBS SP1 at that time.
Everything in the network seems to be working fine, my Trend AV scans did
not find anything. I have an issue with my XP laptop giving me a
"applnch.exe - Entry Point Not Found" but I did not think this was
related.

Any ideas as to what is going on here?

Thanks

Terry Mc


****

Event Type: Failure Audit
Event Source: Security
Event Category: Logon/Logoff
Event ID: 529
Date: 4/25/2006
Time: 10:57:38 AM
User: NT AUTHORITY\SYSTEM
Computer: SBSServer
Description:
Logon Failure:
Reason: Unknown user name or bad password
User Name:
Domain: ADMIN1
Logon Type: 3
Logon Process: NtLmSsp
Authentication Package: NTLM
Workstation Name: ADMIN1
Caller User Name: -
Caller Domain: -
Caller Logon ID: -
Caller Process ID: -
Transited Services: -
Source Network Address: 192.168.16.38
Source Port: 4668







.

Relevant Pages

  • Another Event 529
    ... I am loging hundreds of NT AUTHORITY\SYSTEM Logon failures from my ... All workstation seem to be getting triggering the ... same event with different Source Port #'s. ... Caller User Name: - ...
    (microsoft.public.windows.server.sbs)
  • Re: Another Event 529
    ... I am loging hundreds of NT AUTHORITY\SYSTEM Logon failures from my ... All workstation seem to be getting triggering the ... same event with different Source Port #'s. ... Caller User Name: - ...
    (microsoft.public.windows.server.sbs)
  • Re: Another Event 529
    ... I am loging hundreds of NT AUTHORITY\SYSTEM Logon failures from my ... All workstation seem to be getting triggering ... same event with different Source Port #'s. ... Caller User Name: - ...
    (microsoft.public.windows.server.sbs)
  • Re: Another Event 529
    ... I am loging hundreds of NT AUTHORITY\SYSTEM Logon failures from my ... All workstation seem to be getting triggering ... same event with different Source Port #'s. ... Caller User Name: - ...
    (microsoft.public.windows.server.sbs)
  • Re: Event ID 539 & 529 in large numbers - from what?
    ... When I get an account locking out without obvious cause, I just go in and delete all the saved passwords. ... Both the username and the workstation name are legitimate user/workstation on the network. ... Logon Failure: ... Caller User Name: - ...
    (microsoft.public.windows.server.sbs)