Re: Logon type 3 - ID 529

Hi Teneo,

No, nothing has been installed recently on these machines. No service packs
done recently either. I couldnt see anything in the logs too. The only error
message I found around the same time as an alert this morning was:

The time provider NtpClient is currently receiving valid data from
server.domain.local (ntp.d|0.0.0.0:123->serverip:123).

Though this seems harmless.

I'll have to keep an eye on it as its making me uneasy :-/

"Teneo" wrote:

Hi Mehdis..

Do the workstations have anything in their app/security/system logs
corresponding to the same time as the server log..?

As they are vista, has SP1 been applied recently ? Not that I am aware of
any issues though.

Has anything else been applied / configured to those pcs recently


"Mehdis" <Mehdis@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:8C8DDFA6-BF1D-4CE3-BB47-5262FD20ED1A@xxxxxxxxxxxxxxxx
Hi all,

Late this afternoon I received around 80 failed security login alerts from
3
computers in the office (these 3 machines are all vista). It's the first
time
this seems to have happened. One of the users wasn't even using their PC
when
the alert appeared.

Details are:

Event ID: 529
Logon Failure:
Reason: Uknown user name or bad password
Domain: companydomain
Logon Type: 3
Logon Process: NtLmSsp
Authentication Package: NTLM
Workstation Name: VISTAMACHINE

All other fields are blank including 'User Name'

I've read logon type 3 can be caused due to access of shared
folders/printers but doesnt explain why its suddenly occuring now.

Any ideas to why this occuring would be much appreciated!




.

Relevant Pages

  • SID Issue after Upgrading to AD to W2K3?
    ... A user starts to get the logon prompt when opening Outlook from a computer ... This also seems to generate the following logs in the users System Event log ... Changing the SID of the machines seems to correct the problem, ... We do Ghost machines, however, we use SysPrep. ...
    (microsoft.public.windows.server.general)
  • RE: Default printer keeps changing on its own for every user
    ... Are users logging in from different machines? ... i.e. Julie logs on in the office where her default printer is ... Microsoft MVP - Terminal Server ... > auto create only the default printer and all pritner are installed as local ...
    (microsoft.public.windows.terminal_services)
  • Re: [SLE] logdigest and mail problem
    ... I have two SUSE Linux 9.3 Professional machines here. ... still have off site logs. ... I just installed another fresh install and set up everything, ... Your sender address uses a domain name that is not resolvable outside your network. ...
    (SuSE)
  • Re: Shutdown takes over 30 minutes!!
    ... Do either or both machines use Fast User Switching & are there any ... do a check of System/Application event logs. ... yet both experience the exceedingly long shutdowns. ... > related to how long the system has been running since the last reboot. ...
    (microsoft.public.windowsxp.general)
  • RE: [fw-wiz] Netscreen email logging
    ... Steve's suggestion below ("set firewall log-self") may have been ... The Netscreen is now sending logs. ... alarm 2 minutes after the first, it will buffer that alarm and send ... "set admin mail alert" has not been set. ...
    (Firewall-Wizards)