Event ID 539 & 529 in large numbers - from what?

Hello all,

Wondered if anyone can point me in the right direction for identifying what
may be causing the following, which started appearing in the event logs
today (SBS 2003). The only thing unique about this particular workstation
is that it's running Sage Payroll with data on the SBS as a share. The
company only has two other laptops alongside this workstation and the small
business server, and 1 printer. Therefore this large number of failures was
somewhat alarming when reading through the reports today! All computers and
laptops are running legitimate copies of XP, with AVG Small Business
Internet Security edition on server & all computers. All are up to date
with windows critical & security updates bar SP3.

Source Event ID Last Occurrence Total Occurrences
Security 539 20/05/2008 14:35 12,232 *
Logon Failure:
Reason: Account locked out
User Name: <username>
Domain: <domain name>
Logon Type: 3
Logon Process: NtLmSsp
Authentication Package: NTLM
Workstation Name: <workstation name>
Caller User Name: -
Caller Domain: -
Caller Logon ID: -
Caller Process ID: -
Transited Services: -
Source Network Address: 10.0.0.53
Source Port: 0


Source Event ID Last Occurrence Total Occurrences
Security 529 20/05/2008 14:31 117 *
Logon Failure:
Reason: Unknown user name or bad password
User Name: <username>
Domain: <domain name>
Logon Type: 3
Logon Process: NtLmSsp
Authentication Package: NTLM
Workstation Name: <workstation name>
Caller User Name: -
Caller Domain: -
Caller Logon ID: -
Caller Process ID: -
Transited Services: -
Source Network Address: 10.0.0.53
Source Port: 0

Many thanks,

Ruth






.

Relevant Pages

  • Re: Event ID 539 & 529 in large numbers - from what?
    ... When I get an account locking out without obvious cause, I just go in and delete all the saved passwords. ... Both the username and the workstation name are legitimate user/workstation on the network. ... Logon Failure: ... Caller User Name: - ...
    (microsoft.public.windows.server.sbs)
  • Re: Event ID 539 & 529 in large numbers - from what?
    ... Part of what I meant though, is that <username> could be the name of a user or the name of a machine, when a machine is connecting to the server to get group policies, for example. ... Both the username and the workstation name are legitimate user/workstation on the network. ... Logon Failure: ... Caller User Name: - ...
    (microsoft.public.windows.server.sbs)
  • Re: You are not authorized to view this page
    ... AUTHORITY\SYSTEM BAY18 "Logon Failure: ... Logon Process: Kerberos ... Caller User Name: - ...
    (microsoft.public.inetserver.iis.security)
  • Re: You are not authorized to view this page
    ... Here is the record from the Sytem Log for Kerberos ... AUTHORITY\SYSTEM BAY18 "Logon Failure: ... Logon Process: Kerberos ... Caller User Name: - ...
    (microsoft.public.inetserver.iis.security)
  • Re: Failure Audit in Security Logs
    ... Event Type: Failure Audit ... Logon Failure: ... Logon Process: NtLmSsp ... Caller User Name: - ...
    (microsoft.public.windows.server.sbs)
Loading