Server Performance Report Question

Tech-Archive recommends: Fix windows errors by optimizing your registry

I am getting daily Server Performance Reports from my SBS 2003 server. In
that report there are "Critical Errors in Security Log" where there are logon
failures. There are 2 strange things I see and I'd like to further
understand.

1. I have a user, called jsmith, who has a failure for "Unknown user name
or bad password". jsmith is a user on the SBS network but in the Total
Occurences field I see 2,284 as the count. 2,284... that's alot of
occurances for failure so it makes no sense

2. I have a user, called mjane, who has a the same failure BUT this user is
not a user on the SBS network and I suspect is an attack from the internet
since the SBS server is hooked directly to the DSL without router so all
ports are open. Now this one scares me more.

What is going on here and more importantly where can I go to further
understand this type of messages including the other specs such as logon
type, process, workstation and user name etc. that are part of the error? Is
there also a way I can query into the log to see other such occurences? Is
this the event viewer log or is there information in the SQLMonitoring
database as well?

Thanks!

-Richard K

.

Relevant Pages

  • RE: Problems with 529 Events
    ... attempting to logon on some services on the SBS server. ... and then click Account Lockout Policy. ...
    (microsoft.public.windows.server.sbs)
  • RE: Logon Issue - could someone explain please
    ... I understand that you get security event 540 ... When a user connects to the shared folder on the SBS server, ... logon auditing, ...
    (microsoft.public.windows.server.sbs)
  • RE: Trend, IIS, Permissions, Exhaustion and close to very bad language :-) Heelp!
    ... I understand when you logon on Company web ... Does the IP address point your Windows XP clients or SBS Server? ... Is the IP address of the Windows XP client or server that in your network? ...
    (microsoft.public.windows.server.sbs)
  • RE: Kerberos Security Error 537 on log off
    ... "Logon Type: 3" means that it is a network logon. ... please check the SBS Server and the client computers from ... Directory users and Computers or open the Server Management, ... Collect Kerberos event log in the authentication server. ...
    (microsoft.public.windows.server.sbs)
  • Re: Critical Errors in Security Log
    ... Welcome to SBS newsgroup. ... attempted logon is invalid. ... I would like to suggest you go to the SBS 2003 server ... Microsoft CSS Online Newsgroup Support ...
    (microsoft.public.windows.server.sbs)