Re: Vista and Fax Client on SBS 2003

2 more earlier errors:

Could Vista be trying to logon to the domain with the built in system
account on thw workstation which shouldn't work!



Event Type: Failure Audit
Event Source: Security
Event Category: Account Logon
Event ID: 675
Date: 20/08/2008
Time: 07:04:47
User: NT AUTHORITY\SYSTEM
Computer: MAIN-SERVER
Description:
Pre-authentication failed:
User Name: xxxxx
User ID: yyyy\xxxx
Service Name: krbtgt/[Long form domain name]
Pre-Authentication Type: 0x0
Failure Code: 0x19
Client Address: 192.168.10.13

-----------------------------------------------------------------------

Event Type: Failure Audit
Event Source: Security
Event Category: Account Logon
Event ID: 673
Date: 20/08/2008
Time: 07:04:47
User: NT AUTHORITY\SYSTEM
Computer: MAIN-SERVER
Description:
Service Ticket Request:
User Name:
User Domain:
Service Name:
Service ID: -
Ticket Options: 0x2
Ticket Encryption Type: -
Client Address: 192.168.10.13
Failure Code: 0x20
Logon GUID: -
Transited Services: -


For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.


For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.


"Mark Heaton" wrote:

Fair Point!
Here they are in reverse chronological order. It looks like the SYSTEM
account is being used for something and the login account yyyy\xxxx for
something else.

----------------------------------------------------------------------------------------

Event Type: Failure Audit
Event Source: Security
Event Category: Logon/Logoff
Event ID: 529
Date: 20/08/2008
Time: 07:04:57
User: NT AUTHORITY\SYSTEM
Computer: MAIN-SERVER
Description:
Logon Failure:
Reason: Unknown user name or bad password
User Name: xxxx
Domain: yyyy
Logon Type: 3
Logon Process: NtLmSsp
Authentication Package: NTLM
Workstation Name: zzzz
Caller User Name: -
Caller Domain: -
Caller Logon ID: -
Caller Process ID: -
Transited Services: -
Source Network Address: -
Source Port: -


For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

----------------------------------------------------------------------------------------
Event Type: Failure Audit
Event Source: Security
Event Category: Account Logon
Event ID: 680
Date: 20/08/2008
Time: 07:04:57
User: NT AUTHORITY\SYSTEM
Computer: aaaaa
Description:
Logon attempt by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon account: xxxxx
Source Workstation: zzzzzz
Error Code: 0xC000006A


For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.


----------------------------------------------------------------------------------------
Event Type: Failure Audit
Event Source: Security
Event Category: Logon/Logoff
Event ID: 529
Date: 20/08/2008
Time: 07:04:57
User: NT AUTHORITY\SYSTEM
Computer: aaaaaa
Description:
Logon Failure:
Reason: Unknown user name or bad password
User Name: xxxxx
Domain: yyyyy
Logon Type: 3
Logon Process: NtLmSsp
Authentication Package: NTLM
Workstation Name: zzzzzz
Caller User Name: -
Caller Domain: -
Caller Logon ID: -
Caller Process ID: -
Transited Services: -
Source Network Address: -
Source Port: -


For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.


----------------------------------------------------------------------------------------
Event Type: Failure Audit
Event Source: Security
Event Category: Account Logon
Event ID: 680
Date: 20/08/2008
Time: 07:04:57
User: NT AUTHORITY\SYSTEM
Computer: MAIN-SERVER
Description:
Logon attempt by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon account: xxxx
Source Workstation: zzzz
Error Code: 0xC000006A


For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.


"Matabra" wrote:

Hi,

There probably is a solution but we will need some more information.

Is there a reason why you cant post the eventlogs here? You normally get
much better help when more people can take a look.

If needsbe sanitise the log by changing server names etc, but leave the
error intact.

Regards,

Matt

"Mark Heaton" <mcfh@xxxxxxxxxxxxxxxxxxx> wrote in message
news:75805091-AD34-47E0-AB07-83237966C60C@xxxxxxxxxxxxxxxx
I see the variety of posts on this that there is an issue that some users
are
experiencing with Vista clients trying to send faxes.

I am suffering from this. I can see that there are 4 logon failures
recorded
in the event log when I try and add the fax (running in UAC elevated)
server.

Is there a solution to this - happy to provide more details e.g. the event
log but only privately.

Thanks
Mark


.

Relevant Pages

  • Re: Problem with self hosting under the NetworkService account
    ... On Vista I run as an Administrator, ... and you're using http channel, therefore, I think it is likely the cause. ... http url on vista machine(for a certain user account). ... Microsoft MSDN Online Support Lead ...
    (microsoft.public.dotnet.framework.webservices)
  • RE: How to enable IWA over multiple servers
    ... Boot up computer and logon as ActiveDirectory username (im joe ... a member of 192.168.0.4 (the web server), ... through a local account on the webserver rather than a domain user ... Microsoft MSDN Online Support Lead ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • RE: proper way to insert program for run on startup in Vista
    ... Yes, on Vista, a normal process runs under Admin Approval mode if you used ... "Administrators" group or Local System account, ... Microsoft Online Community Support ...
    (microsoft.public.platformsdk.security)
  • RE: How to enable IWA over multiple servers
    ... Boot up computer and logon as ActiveDirectory username (im joe bloggs, ... member of 192.168.0.4 (the web server), ... are you logon through a local account on the ... Microsoft MSDN Online Support Lead ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: Youve tried to sign in too many times with incorrect e-mail addre
    ... There is also a rash of not being able to load the ... Since you have a paid account in my opinion being locked out is a Customer ... Support, ... I get this message each time I try to logon to my hotmail plus account, ...
    (microsoft.public.internet.mail)