Event ID 529 on cleint workstation

Hi,

I've been recieving this odd event ID for a while now. I've never
payed much attention to it until recently and need help with a
solution.

Logon Failure:
Reason: Unknown user name or bad password
User Name: abc103
Domain: FRONT-DESK
Logon Type: 3
Logon Process: NtLmSsp
Authentication Package: NTLM
Workstation Name: FRONT-DESK
Caller User Name: -
Caller Domain: -
Caller Logon ID: -
Caller Process ID: -
Transited Services: -
Source Network Address: 192.168.0.20
Source Port: 0

I've had as much as 43 occurences logged in one day and its a bit
wiered.

According to the KB articles i've read from Microsoft and GoogleGroups.
this event is logged during the log-off procedure when the client
machine tries to authenticate the user with the domain controller that
it is connected to, this error occurs because the user (which is a
local user and not listed on the DC) is not found.

-The Client computer is a Windows XP SP 2 Machine, up to date with
patches.

Microsoft has a hotfix which it says is also available within SP 2,
the hotfix i cannot install because it states the machine already
contains it (since its SP2).

Any one have any ideas on how i should proceed in solving this?


Best Regards and much thanks,

Farhan S.

.

Relevant Pages

  • Re: You are not authorized to view this page
    ... Here is the record from the Sytem Log for Kerberos ... AUTHORITY\SYSTEM BAY18 "Logon Failure: ... Logon Process: Kerberos ... Caller User Name: - ...
    (microsoft.public.inetserver.iis.security)
  • Re: You are not authorized to view this page
    ... IIS and Kerberos Part 2 - What are Service Principal Names? ... on logon session ... 30/04/2007 12:04:47 PM Security Failure Audit Logon/Logoff 529 NT AUTHORITY\SYSTEM BAY18 "Logon Failure: ... Caller User Name: - ...
    (microsoft.public.inetserver.iis.security)
  • Re: You are not authorized to view this page
    ... Kerberos authN is failing for some reason, ... 30/04/2007 12:04:47 PM Security Failure Audit Logon/Logoff 529 NT AUTHORITY\SYSTEM BAY18 "Logon Failure: ... Logon Type: 3 ... Caller User Name: - ...
    (microsoft.public.inetserver.iis.security)
  • Re: You are not authorized to view this page
    ... AUTHORITY\SYSTEM BAY18 "Logon Failure: ... Logon Process: Kerberos ... Caller User Name: - ...
    (microsoft.public.inetserver.iis.security)
  • Exchange, Event 537, and Access Denied, Oh my
    ... an error occurred during logon ... caller user name: - ... fails (which is what started me investigating this server in the first ... the authentication between the pda and iis occurs fine, ...
    (microsoft.public.windows.server.sbs)