Re: Logon type 3 - ID 529
- From: v-mzhuan@xxxxxxxxxxxxxxxxxxxx (Manfred Zhuang [MSFT])
- Date: Fri, 07 Mar 2008 10:03:50 GMT
Hello Customer,
Thank you for your reply.
From your post, I understand that error 529 is found in event log.
This behavior can happen when the machine password is not properly sync.
Let's perform following step to reset the machine account password of a
domain controller:
NETDOM RESETPWD /Server:ServerName /UsedD:Administrator /PasswordD:*
For example:
NOTE: Please run the command on the server named DOC-MAIL
NETDOM RESETPWD /Server:DOC-MAIL /UsedD:Administrator
/PasswordD:ThePasswordForAdministratorAccount
After that, please restart the server.
I hope the above information is helpful to you. If the problem still
occurs, please help me gather following information:
Please download the MPS Report tool from the following link and run it on
the SBS server, then send the generated CAB file to my mailbox
v-mzhuan@xxxxxxxxxxxxx for further investigation so that we can find what
the root cause is:
http://download.microsoft.com/download/b/b/1/bb139fcb-4aac-4fe5-a579-30b0bd9
15706/MPSRPT_SETUPPerf.EXE
For your information:
http://www.microsoft.com/downloads/details.aspx?FamilyId=CEBF3C7C-7CA5-408F-
88B7-F9C79B7306C0&displaylang=en
Please try the above steps at your earliest convenience. If you have any
concern, please feel free to let me know.
Best regards,
Manfred Zhuang(MSFT)
Microsoft Online Newsgroup Support
Get Secure! - www.microsoft.com/security
=====================================================
This newsgroup only focuses on SBS technical issues. If you have issues
regarding other Microsoft products, you'd better post in the corresponding
newsgroups so that they can be resolved in an efficient and timely manner.
You can locate the newsgroup here:
http://www.microsoft.com/communities/newsgroups/en-us/default.aspx
When opening a new thread via the web interface, we recommend you check the
"Notify me of replies" box to receive e-mail notifications when there are
any updates in your thread. When responding to posts via your newsreader,
please "Reply to Group" so that others may learn and benefit from your
issue.
Microsoft engineers can only focus on one issue per thread. Although we
provide other information for your reference, we recommend you post
different incidents in different threads to keep the thread clean. In doing
so, it will ensure your issues are resolved in a timely manner.
For urgent issues, you may want to contact Microsoft CSS directly. Please
check http://support.microsoft.com for regional support phone numbers.
Any input or comments in this thread are highly appreciated.
=====================================================
This posting is provided "AS IS" with no warranties, and confers no rights.
--------------------
| Thread-Topic: Logon type 3 - ID 529
| thread-index: Ach+9pwhP0X+HsbgS0u+M02bKGgUbQ==
| X-WBNR-Posting-Host: 207.46.19.197
| From: =?Utf-8?B?TWVoZGlz?= <Mehdis@xxxxxxxxxxxxxxxxxxxxxxxxx>
| References: <8C8DDFA6-BF1D-4CE3-BB47-5262FD20ED1A@xxxxxxxxxxxxx>
<O8LGkfjfIHA.320@xxxxxxxxxxxxxxxxxxxx>
| Subject: Re: Logon type 3 - ID 529
| Date: Wed, 5 Mar 2008 11:25:02 -0800
| Lines: 59
| Message-ID: <5C8F8147-6EF6-4F64-AE75-7E82A2F0F7EF@xxxxxxxxxxxxx>
| MIME-Version: 1.0
| Content-Type: text/plain;
| charset="Utf-8"
| Content-Transfer-Encoding: 7bit
| X-Newsreader: Microsoft CDO for Windows 2000
| Content-Class: urn:content-classes:message
| Importance: normal
| Priority: normal
| X-MimeOLE: Produced By Microsoft MimeOLE V6.00.3790.2992
| Newsgroups: microsoft.public.windows.server.sbs
| Path: TK2MSFTNGHUB02.phx.gbl
| Xref: TK2MSFTNGHUB02.phx.gbl microsoft.public.windows.server.sbs:96578
| NNTP-Posting-Host: tk2msftibfm01.phx.gbl 10.40.244.149
| X-Tomcat-NG: microsoft.public.windows.server.sbs
|
| Hi Teneo,
|
| No, nothing has been installed recently on these machines. No service
packs
| done recently either. I couldnt see anything in the logs too. The only
error
| message I found around the same time as an alert this morning was:
|
| The time provider NtpClient is currently receiving valid data from
| server.domain.local (ntp.d|0.0.0.0:123->serverip:123).
|
| Though this seems harmless.
|
| I'll have to keep an eye on it as its making me uneasy :-/
|
| "Teneo" wrote:
|
| > Hi Mehdis..
| >
| > Do the workstations have anything in their app/security/system logs
| > corresponding to the same time as the server log..?
| >
| > As they are vista, has SP1 been applied recently ? Not that I am aware
of
| > any issues though.
| >
| > Has anything else been applied / configured to those pcs recently
| >
| >
| > "Mehdis" <Mehdis@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
| > news:8C8DDFA6-BF1D-4CE3-BB47-5262FD20ED1A@xxxxxxxxxxxxxxxx
| > > Hi all,
| > >
| > > Late this afternoon I received around 80 failed security login alerts
from
| > > 3
| > > computers in the office (these 3 machines are all vista). It's the
first
| > > time
| > > this seems to have happened. One of the users wasn't even using their
PC
| > > when
| > > the alert appeared.
| > >
| > > Details are:
| > >
| > > Event ID: 529
| > > Logon Failure:
| > > Reason: Uknown user name or bad password
| > > Domain: companydomain
| > > Logon Type: 3
| > > Logon Process: NtLmSsp
| > > Authentication Package: NTLM
| > > Workstation Name: VISTAMACHINE
| > >
| > > All other fields are blank including 'User Name'
| > >
| > > I've read logon type 3 can be caused due to access of shared
| > > folders/printers but doesnt explain why its suddenly occuring now.
| > >
| > > Any ideas to why this occuring would be much appreciated!
| > >
| >
| >
| >
|
.
- References:
- Re: Logon type 3 - ID 529
- From: Teneo
- Re: Logon type 3 - ID 529
- From: Mehdis
- Re: Logon type 3 - ID 529
- Prev by Date: SharePoint Database Files Increasing in size every Day
- Next by Date: Re: Wake up PCs via RWW
- Previous by thread: Re: Logon type 3 - ID 529
- Next by thread: Re: distribution groups
- Index(es):
Relevant Pages
|
