Re: Security Event 529 is logged for a local user account

Hi Attika

I am trying to get to the bottom of this as seeing this at every client
site... Haven't had that many in one hit but we have found this happens when
some pcs do not have the right time with the server, could this be the issue
with your rogue pc?

However, even correcting time issues that particular pc doesn't generate the
error but another does...LOL

It is always the Logon Type 3 NtLmsp / NTLM and happens infrequently to
monitor but regular to the annoying stage.


"Attika" <acsokai_n0spam@xxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:uOKo8u5cGHA.536@xxxxxxxxxxxxxxxxxxxxxxx
The other day, the daily report indicated that there were 358 failed login
attempts from a user's computer in one day. Researching the issue I found
that there is a KB811082 that talkes about this issue. See link:
http://support.microsoft.com/default.aspx?scid=kb;en-us;811082
Workaround One is to apply SP2 for XP, which the machine already has, and
to apply a hotfix to Server 2003 (and SBS 2003 I would think). Now, since
this KB was released in October 2005, I thought this may have been in
incorporated into an official update. Howver the server is also up to date
with all security updates for all its components.

BTW, here is the event log:
Logon Failure:
Reason: Unknown user name or bad password
User Name: Joe Smith
Domain: STATION5
Logon Type: 3
Logon Process: NtLmSsp
Authentication Package: NTLM
Workstation Name: STATION5
Caller User Name: -
Caller Domain: -
Caller Logon ID: -
Caller Process ID: -
Transited Services: -
Source Network Address: 192.168.16.106
Source Port: 0



.

Relevant Pages

  • Re: Security Event 529 is logged for a local user account
    ... When Windows XP Home are on the network and have network drives defined ... It is always the Logon Type 3 NtLmsp / NTLM and happens infrequently to ... Caller User Name: - ... Source Network Address: 192.168.16.106 ...
    (microsoft.public.windows.server.sbs)
  • Re: Security Event 529 is logged for a local user account
    ... When Windows XP Home are on the network and have network drives defined ... It is always the Logon Type 3 NtLmsp / NTLM and happens infrequently to ... Caller User Name: - ... Source Network Address: 192.168.16.106 ...
    (microsoft.public.windows.server.sbs)
  • RE: Event ID 529
    ... Logon Failure: ... Caller User Name: MYSVRNAME$ ... Source Network Address: - ... Logon Process: NtLmSsp ...
    (microsoft.public.windows.server.sbs)
  • Security Event 529 is logged for a local user account
    ... Logon Process: NtLmSsp ... Caller User Name: - ... Source Network Address: 192.168.16.106 ...
    (microsoft.public.windows.server.sbs)
  • Re: Event ID 529
    ... Logon Failure: ... Logon Process: ... Caller User Name: ... Source Network Address: ...
    (microsoft.public.windows.server.sbs)