Re: Event 529 occuring 2500 times every day

IF you have a chance to post back, I'll be interested to see what happens
after 30 days. If it doesn't clear itself up, you may want to call PSS and
get it sorted out. It makes the security log pretty useless to have that
many irrelevant entries to wade through.


"redeye" <redeye@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:F0E313A6-2E9A-4CFB-A8EC-5521B0D60F76@xxxxxxxxxxxxxxxx
Hi Dave,

Thanks for the advice,

We have no implications other than the error in the logs.
I think I will wait for 30 days to see if it just goes away, otherwise I
will try and reset the password to see if that resolved it.

Many Thanks
Steve

"Dave Nickason [SBS MVP]" wrote:

I had this happen quite a while ago - can't remember if it was SBS 2000
or
2003. I spent a long time - weeks - troubleshooting this with PSS,
including some high-level AD gurus - without ever reaching a resolution.
It
appears that the machine account (HSSSERVER$) is generating these, which
is
what it was in my case. That password changes itself every 30 days
(pretty
sure, but with old age, could be remembering that wrong). Anyway, after
exactly 30 days right to the second, the errors stopped appearing, so we
stopped troubleshooting.

I'm not sure what to advise you on this. You're not having any symptoms
other than the log entries, right? The options are to call PSS and try
to
sort this out with them, ignore the errors and hope they go away after
exactly 30 days, or try to reset the machine account password. There are
KBs on how to do that if you search "reset machine account password" at
support.microsoft.com. I'm not sure if there are implications involved
in
resetting the password, or if there are other possible causes for this
error.


"redeye" <redeye@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:B485CA1E-36FC-4E7B-8BFD-6EB016F505AB@xxxxxxxxxxxxxxxx
Hi All,

I am receiving this error message in my security log about 2500 times
every
day.
Any idea what this means, where it is coming from and how to fix the
issue?

Many Thanks

Event Type: Failure Audit
Event Source: Security
Event Category: Logon/Logoff
Event ID: 529
Date: 08/12/2006
Time: 22:01:09
User: NT AUTHORITY\SYSTEM
Computer: HSSSERVER
Description:
Logon Failure:
Reason: Unknown user name or bad password
User Name: HSSSERVER$
Domain: HSS
Logon Type: 3
Logon Process: NtLmSsp
Authentication Package: NTLM
Workstation Name: HSSSERVER
Caller User Name: -
Caller Domain: -
Caller Logon ID: -
Caller Process ID: -
Transited Services: -
Source Network Address: -
Source Port: -


For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.






.

Relevant Pages

  • Re: Event 529 occuring 2500 times every day
    ... I am receiving this error message in my security log about 2500 ... Logon Failure: ... User Name: HSSSERVER$ ... Caller User Name: - ...
    (microsoft.public.windows.server.sbs)
  • Re: Event 529 occuring 2500 times every day
    ... I am receiving this error message in my security log about 2500 ... Logon Failure: ... Caller User Name: - ...
    (microsoft.public.windows.server.sbs)
  • Re: Event 529 occuring 2500 times every day
    ... Just to let you know the error message has disappeared 30 days after I ... I am receiving this error message in my security log about 2500 ... Logon Failure: ... Caller User Name: - ...
    (microsoft.public.windows.server.sbs)
  • Re: Event 529 occuring 2500 times every day
    ... We have no implications other than the error in the logs. ... Logon Failure: ... User Name: HSSSERVER$ ... Caller User Name: - ...
    (microsoft.public.windows.server.sbs)
  • Logon Failure: Unknown user name or bad password
    ... Recently I have noticed a critical error in the security log. ... Logon Failure: ... Caller User Name: Server1$ ... Awhile back I believe the IUSR account password was changed and it ...
    (microsoft.public.windows.server.sbs)
Loading