Login Error - Microsoft authentication package v1

Logon Failure:


Reason:
Unknown user name or bad password


User Name:
12345


Domain:



Logon Type:
3


Logon Process:
Advapi


Authentication Package:
MICROSOFT_AUTHENTICATION_PACKAGE_V1_0


Workstation Name:
SERVER


Caller User Name:
SERVER$


Caller Domain:
own domain name here, changed by me.


Caller Logon ID:
(0x0,0x3E7)


Caller Process ID:
1716


Transited Services:
-


Source Network Address:
-


Source Port:
-



Seen this posted before but couldn't find orig details and maybe its way
back down the list so thought post again.

I have found that this is related to login on port 25. (SMTP) if not aware
that password on port 25 is base64. Testing with normal password
gives gobblegook. Try login with base64 username and password and get exact
result.

Seeing alot of attacks on port 25 recently.



.

Relevant Pages

  • Event ID 529
    ... Logon Failure: ... Unknown user name or bad password ... Caller User Name: ...
    (microsoft.public.windows.server.sbs)
  • RE: Error when opening Outlook Express
    ... 'mymail.phoenix.edu', Protocol: IMAP, Server Response: 'Logon failure: ... unknown user name or bad password.', Port: 993, Secure: Yes, Error ...
    (microsoft.public.windows.inetexplorer.ie6_outlookexpress)
  • Re: Another security question/issue.
    ... There are now MASSIVE attacks on port 25 all over the world. ... is trying to hack port 25, hack server / try to relay. ... Logon Process: Advapi ... Caller User Name: servername$ ...
    (microsoft.public.windows.server.sbs)
  • [PATCH 2.6.14-rc2 2/2] libata: Marvell function headers
    ... * @base: port base address ... * LOCKING: ... * Inherited from caller. ... * Disable ints, cleanup host memory, call general purpose ...
    (Linux-Kernel)
  • Re: EventID 529 Logged 1723 Times in one Day!
    ... David @ Solsletta ... I guess I could change the port assignments. ... > Caller Domain: MACPROSOL ...
    (microsoft.public.windows.server.sbs)