RE: security logon failures

HI Jacky,
Thanks for your reply. In the security event log there is no source network
address appearing at all, it does say that the workstation name is sbsntsrv2.
With regard to disabling services and drivers as the error message is
intermittent we would need to nearly do this for a month and this is really
not feasible as we would need them services and drivers working. Also at the
end of your message you mentioned why not try a virus, I assume you mean
virus scan and yes I have ran adware,spyware and virus scan and nothing
appears. Do you think it is something on the server itself a virus or someone
from outside trying to hack in. ok thanks again for your help.
--
Paploo77


""Jacky Luo [MSFT]"" wrote:

Hi Paploo77,

Thanks for posting back.

Firstly, I want to confirm with you what is the exact IP address about
network source address you have seen. Is it sbsntsrv2 itself? Besides,
please perform a clean boot. To isolate the issue, I suggest that you
temporarily disconnect the SBS server from the internet and perform a clean
boot on the server. A Clean Boot will allow us to isolate any device
drivers or programs that are loading at startup that may be causing a
conflict with other device drivers or programs that are installed in your
computer.

You may run the following steps to perform clean boot:

a. Click Start, and then click Run.

b. In the Open text box, type MSCONFIG then click OK.

c. On the System Configuration Utility window, click the Startup tab and
click the "Disable All" button to remove the checkmarks from each line in
the list.

d. Then, click the Services tab, add a checkmark to the "Hide All Microsoft
Services" item then click "Disable All".

Note: This disables all third party service items.

e. Click the OK button and restart your computer. Please ensure that all
the third party related services are stopped (services.msc) on the SBS
server.

f. Then please monitor the server to see if it helps.

I do not know what kind of software have been installed on your server, if
it affect your business, you can perform the clean boot at your
convenience, such as weekend, to see if it helps, if clean boot do not
work, you can disconnect the server from the network at your non-business
time, to see if the event appear, If so, maybe a virus do the trick. Please
let me know your result.

I appreciate your time. I am happy to be of assistance and look forward to
your reply.

Best regards,

Jacky Luo (MSFT)
Microsoft CSS Online Newsgroup Support

Get Secure! - www.microsoft.com/security
====================================================
PLEASE NOTE: The partner managed newsgroups are provided to
assist with break/fix issues and simple how to questions.
We also love to hear your product feedback! Let us know what you think by
posting

from the web interface: Partner Feedback
from your newsreader: microsoft.private.directaccess.partnerfeedback.

We look forward to hearing from you!
====================================================
When responding to posts, please "Reply to Group" via your newsreader
so that others may learn and benefit from this issue.
====================================================
This posting is provided "AS IS" with no warranties, and confers no rights.


.

Quantcast