Re: Security Event 529...please help....

Is you laptop name SBS1?

This can happen if you have a presistent network connenction or a service
with an invalid password. Disjoin the laptop from the domain, reboot and
then use connectcomputer to join it back in. See if the error still shows
up.

Claus

"RichardF" <RichardF@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:EA12679A-3FF5-41FB-8533-ACC5174E65D6@xxxxxxxxxxxxxxxx
Has anyone found a fix for this yet?
I have a lab computer with SBS 2003 standard SP1 and all current patches.
I
powered down the computer a couple of months ago and recently started it
back
up for another project. After applying the current patches I started
having
this same problem soon after.
From the server report:

Source Event ID Last Occurrence Total Occurrences
Security 529 5/13/2006 5:45 AM 2,049 *
Logon Failure:
Reason: Unknown user name or bad password
User Name: SBS1$
Domain: FRYSNETSERVICES
Logon Type: 3
Logon Process: NtLmSsp
Authentication Package: NTLM
Workstation Name: SBS1
Caller User Name: -
Caller Domain: -
Caller Logon ID: -
Caller Process ID: -
Transited Services: -
Source Network Address: -
Source Port: -

I receive about 2100 entries a day. I only have one workstation on the
network and it is rarely turned on.

Thanks for any help.


"Art Vandalay" wrote:


Brand new SBS 2003 Server setup with SBS 2003 SP1, Exchange 2003
Server SP2, and all the latest patches from Microsoft Update site is
producing the following event in the Security Event Log:

Source : Security
Category : Logon/Logoff
Event ID : 529
Logon failure
Reason : Unknown user name or bad password
Username : SERVER1$
Domain : SYS3
Logon Type : 3
Logon Process : NtLmSsp
Authentication Package : NTLM
Workstation Name : SERVER1
Caller User Name : -
Caller Domain : -
Caller Logon ID : -
Caller Process ID : -
Transited Services : -
Source Network Address : -
Source Port : -

I've isolated the PIDs producing the event to the following processes:

inetinfo.exe
store.exe
wmiprvse.exe

As always, any help is greatly appreciated....



.

Relevant Pages

  • Re: Event ID 529
    ... First is a hardware firewall that sits on the perimeter of your network and requires that your users give user names and passwords, different from those for the network. ... Sometimes the Logon Type is different, also the User Name can be ... Computer: <SERVER NAME> ... Caller User Name: $ ...
    (microsoft.public.windows.server.sbs)
  • Re: Security Event 529...please help....
    ... The account that is creating the logon error is the system account, ... I have tried rebooting the server several times. ... the network that is only turned on occasionally. ... Caller User Name: - ...
    (microsoft.public.windows.server.sbs)
  • Re: Event ID 529 Question
    ... Logon Failure: ... Caller User Name: SERVER01$ ... There is no "Mickey" user on our network, so it worries me that we have a hacker trying to get in using brute force logins as this occurred 45 times. ... Usually when you get this you see a source port and source IP Address, ...
    (microsoft.public.windows.server.sbs)
  • Re: Help needed with Critical Errors in Security Log
    ... but you can look for the Caller Process ID. ... Logon Type 5 is Service logon issue- service uses an account. ... How to Setup Windows, Network, VPN & Remote Access on ...
    (microsoft.public.windows.server.sbs)
  • Re: Logon Server Unavailable
    ... There are currently no logon servers available to service ... You use a office laptop to connect the office VPN, when you map a network ... you may receive this message: "This account is the ... The server is not configured for transactions"> "A domain controller for your domain could not be contacted" ...
    (microsoft.public.windows.server.general)