|
| |||||||||
| Tags: micro, trend, wfbs |
Sponsored Links
Trend Micro WFBS - not!
Small Business Server
 |
| | Thread Tools | Search this Thread |
|
| |||||||||
| Tags: micro, trend, wfbs |
|
| | Thread Tools | Search this Thread |
|
#1
22-09-2008
| |||
| |||
| Trend Micro WFBS - not!
Since upgrading my CSM 3.6 to WFBS I have been getting several thousand of these a day: Event Type: Failure Audit Event Source: Security Event Category: Logon/Logoff Event ID: 537 Date: 22/09/2008 Time: 11:44:40 AM User: NT AUTHORITY\SYSTEM Computer: GLIDDEN-SBS2K3 Description: Logon Failure: Reason: An error occurred during logon User Name: Domain: Logon Type: 3 Logon Process: Èù< Authentication Package: NTLM Workstation Name: Status code: 0x80090308 Substatus code: 0x0 Caller User Name: - Caller Domain: - Caller Logon ID: - Caller Process ID: - Transited Services: - Source Network Address: - Source Port: - The login process is not always exactly as shown but very similar. I suspect this is Trend because I saw this a while ago with CSM when the Security Console was opened on the server - it generated one of these events. Anyone else seen this?  |
|
#2
22-09-2008
| |||
| |||
| Re: Trend Micro WFBS - not!
Found this: http://www.microsoft.com/communities...r=US&sloc=&p=1 Exactly my issue - I will try some of thre solutions suggested there. "Bill Glidden" <billyg1943@hotmail.com> wrote in message news:eQI$lWFHJHA.3960@TK2MSFTNGP04.phx.gbl... > Since upgrading my CSM 3.6 to WFBS I have been getting several thousand of > these a day: > > Event Type: Failure Audit > Event Source: Security > Event Category: Logon/Logoff > Event ID: 537 > Date: 22/09/2008 > Time: 11:44:40 AM > User: NT AUTHORITY\SYSTEM > Computer: GLIDDEN-SBS2K3 > Description: > Logon Failure: > Reason: An error occurred during logon > User Name: > Domain: > Logon Type: 3 > Logon Process: Èù< > Authentication Package: NTLM > Workstation Name: > Status code: 0x80090308 > Substatus code: 0x0 > Caller User Name: - > Caller Domain: - > Caller Logon ID: - > Caller Process ID: - > Transited Services: - > Source Network Address: - > Source Port: - > > The login process is not always exactly as shown but very similar. I > suspect this is Trend because I saw this a while ago with CSM when the > Security Console was opened on the server - it generated one of these > events. > > Anyone else seen this? > > |
|
#3
23-09-2008
| |||
| |||
| Re: Trend Micro WFBS - not!
Open Trend Dashboard Select preferences, Global settings Select "Use a Proxy server" Enter account and password. Should be the resolution. -- Les Connor [SBS MVP] ________________________ Get the SBS BPA here: http://support.microsoft.com/kb/940439/en-us "Bill Glidden" <billyg1943@hotmail.com> wrote in message news:egixbpFHJHA.1716@TK2MSFTNGP05.phx.gbl... > Found this: > > http://www.microsoft.com/communities...r=US&sloc=&p=1 > > Exactly my issue - I will try some of thre solutions suggested there. > > "Bill Glidden" <billyg1943@hotmail.com> wrote in message > news:eQI$lWFHJHA.3960@TK2MSFTNGP04.phx.gbl... >> Since upgrading my CSM 3.6 to WFBS I have been getting several thousand >> of these a day: >> >> Event Type: Failure Audit >> Event Source: Security >> Event Category: Logon/Logoff >> Event ID: 537 >> Date: 22/09/2008 >> Time: 11:44:40 AM >> User: NT AUTHORITY\SYSTEM >> Computer: GLIDDEN-SBS2K3 >> Description: >> Logon Failure: >> Reason: An error occurred during logon >> User Name: >> Domain: >> Logon Type: 3 >> Logon Process: Èù< >> Authentication Package: NTLM >> Workstation Name: >> Status code: 0x80090308 >> Substatus code: 0x0 >> Caller User Name: - >> Caller Domain: - >> Caller Logon ID: - >> Caller Process ID: - >> Transited Services: - >> Source Network Address: - >> Source Port: - >> >> The login process is not always exactly as shown but very similar. I >> suspect this is Trend because I saw this a while ago with CSM when the >> Security Console was opened on the server - it generated one of these >> events. >> >> Anyone else seen this? >> >> > > |
|
#4
24-09-2008
| |||
| |||
| Re: Trend Micro WFBS - not!
Hi Les, Tried that (mentioned in referenced thread) but no joy. Would I need to restart the server or any services to make this active? Bill "Les Connor [SBS MVP]" <les.connor@DEL.cfive.ca> wrote in message news:%23S2y1bZHJHA.3668@TK2MSFTNGP05.phx.gbl... > Open Trend Dashboard > Select preferences, Global settings > Select "Use a Proxy server" > Enter account and password. > > Should be the resolution. > > -- > Les Connor [SBS MVP] > ________________________ > Get the SBS BPA here: > http://support.microsoft.com/kb/940439/en-us > > > "Bill Glidden" <billyg1943@hotmail.com> wrote in message > news:egixbpFHJHA.1716@TK2MSFTNGP05.phx.gbl... >> Found this: >> >> http://www.microsoft.com/communities...r=US&sloc=&p=1 >> >> Exactly my issue - I will try some of thre solutions suggested there. >> >> "Bill Glidden" <billyg1943@hotmail.com> wrote in message >> news:eQI$lWFHJHA.3960@TK2MSFTNGP04.phx.gbl... >>> Since upgrading my CSM 3.6 to WFBS I have been getting several thousand >>> of these a day: >>> >>> Event Type: Failure Audit >>> Event Source: Security >>> Event Category: Logon/Logoff >>> Event ID: 537 >>> Date: 22/09/2008 >>> Time: 11:44:40 AM >>> User: NT AUTHORITY\SYSTEM >>> Computer: GLIDDEN-SBS2K3 >>> Description: >>> Logon Failure: >>> Reason: An error occurred during logon >>> User Name: >>> Domain: >>> Logon Type: 3 >>> Logon Process: Èù< >>> Authentication Package: NTLM >>> Workstation Name: >>> Status code: 0x80090308 >>> Substatus code: 0x0 >>> Caller User Name: - >>> Caller Domain: - >>> Caller Logon ID: - >>> Caller Process ID: - >>> Transited Services: - >>> Source Network Address: - >>> Source Port: - >>> >>> The login process is not always exactly as shown but very similar. I >>> suspect this is Trend because I saw this a while ago with CSM when the >>> Security Console was opened on the server - it generated one of these >>> events. >>> >>> Anyone else seen this? >>> >>> >> >> > |
|
#5
25-09-2008
| |||
| |||
| Re: Trend Micro WFBS - not!
it should be the fix - are you entering the username as domain\username? -- Les Connor [SBS MVP] ________________________ Get the SBS BPA here: http://support.microsoft.com/kb/940439/en-us "Bill Glidden" <billyg1943@hotmail.com> wrote in message news:OhKbnXdHJHA.652@TK2MSFTNGP04.phx.gbl... > Hi Les, > > Tried that (mentioned in referenced thread) but no joy. Would I need to > restart the server or any services to make this active? > > Bill > > "Les Connor [SBS MVP]" <les.connor@DEL.cfive.ca> wrote in message > news:%23S2y1bZHJHA.3668@TK2MSFTNGP05.phx.gbl... >> Open Trend Dashboard >> Select preferences, Global settings >> Select "Use a Proxy server" >> Enter account and password. >> >> Should be the resolution. >> >> -- >> Les Connor [SBS MVP] >> ________________________ >> Get the SBS BPA here: >> http://support.microsoft.com/kb/940439/en-us >> >> >> "Bill Glidden" <billyg1943@hotmail.com> wrote in message >> news:egixbpFHJHA.1716@TK2MSFTNGP05.phx.gbl... >>> Found this: >>> >>> http://www.microsoft.com/communities...r=US&sloc=&p=1 >>> >>> Exactly my issue - I will try some of thre solutions suggested there. >>> >>> "Bill Glidden" <billyg1943@hotmail.com> wrote in message >>> news:eQI$lWFHJHA.3960@TK2MSFTNGP04.phx.gbl... >>>> Since upgrading my CSM 3.6 to WFBS I have been getting several thousand >>>> of these a day: >>>> >>>> Event Type: Failure Audit >>>> Event Source: Security >>>> Event Category: Logon/Logoff >>>> Event ID: 537 >>>> Date: 22/09/2008 >>>> Time: 11:44:40 AM >>>> User: NT AUTHORITY\SYSTEM >>>> Computer: GLIDDEN-SBS2K3 >>>> Description: >>>> Logon Failure: >>>> Reason: An error occurred during logon >>>> User Name: >>>> Domain: >>>> Logon Type: 3 >>>> Logon Process: Èù< >>>> Authentication Package: NTLM >>>> Workstation Name: >>>> Status code: 0x80090308 >>>> Substatus code: 0x0 >>>> Caller User Name: - >>>> Caller Domain: - >>>> Caller Logon ID: - >>>> Caller Process ID: - >>>> Transited Services: - >>>> Source Network Address: - >>>> Source Port: - >>>> >>>> The login process is not always exactly as shown but very similar. I >>>> suspect this is Trend because I saw this a while ago with CSM when the >>>> Security Console was opened on the server - it generated one of these >>>> events. >>>> >>>> Anyone else seen this? >>>> >>>> >>> >>> >> > > |
|
#6
25-09-2008
| |||
| |||
| Re: Trend Micro WFBS - not!
That, and deleting the .notaccount user, is about all I can remember about this. I know I don't have the error on any SBS boxes, but did; you'd think I could remember the resolution :-(. -- Les Connor [SBS MVP] ________________________ Get the SBS BPA here: http://support.microsoft.com/kb/940439/en-us "Les Connor [SBS MVP]" <les.connor@DEL.cfive.ca> wrote in message news:%23aRU2%23nHJHA.2156@TK2MSFTNGP05.phx.gbl... > it should be the fix - are you entering the username as domain\username? > > -- > Les Connor [SBS MVP] > ________________________ > Get the SBS BPA here: > http://support.microsoft.com/kb/940439/en-us > > > "Bill Glidden" <billyg1943@hotmail.com> wrote in message > news:OhKbnXdHJHA.652@TK2MSFTNGP04.phx.gbl... >> Hi Les, >> >> Tried that (mentioned in referenced thread) but no joy. Would I need to >> restart the server or any services to make this active? >> >> Bill >> >> "Les Connor [SBS MVP]" <les.connor@DEL.cfive.ca> wrote in message >> news:%23S2y1bZHJHA.3668@TK2MSFTNGP05.phx.gbl... >>> Open Trend Dashboard >>> Select preferences, Global settings >>> Select "Use a Proxy server" >>> Enter account and password. >>> >>> Should be the resolution. >>> >>> -- >>> Les Connor [SBS MVP] >>> ________________________ >>> Get the SBS BPA here: >>> http://support.microsoft.com/kb/940439/en-us >>> >>> >>> "Bill Glidden" <billyg1943@hotmail.com> wrote in message >>> news:egixbpFHJHA.1716@TK2MSFTNGP05.phx.gbl... >>>> Found this: >>>> >>>> http://www.microsoft.com/communities...r=US&sloc=&p=1 >>>> >>>> Exactly my issue - I will try some of thre solutions suggested there. >>>> >>>> "Bill Glidden" <billyg1943@hotmail.com> wrote in message >>>> news:eQI$lWFHJHA.3960@TK2MSFTNGP04.phx.gbl... >>>>> Since upgrading my CSM 3.6 to WFBS I have been getting several >>>>> thousand of these a day: >>>>> >>>>> Event Type: Failure Audit >>>>> Event Source: Security >>>>> Event Category: Logon/Logoff >>>>> Event ID: 537 >>>>> Date: 22/09/2008 >>>>> Time: 11:44:40 AM >>>>> User: NT AUTHORITY\SYSTEM >>>>> Computer: GLIDDEN-SBS2K3 >>>>> Description: >>>>> Logon Failure: >>>>> Reason: An error occurred during logon >>>>> User Name: >>>>> Domain: >>>>> Logon Type: 3 >>>>> Logon Process: Èù< >>>>> Authentication Package: NTLM >>>>> Workstation Name: >>>>> Status code: 0x80090308 >>>>> Substatus code: 0x0 >>>>> Caller User Name: - >>>>> Caller Domain: - >>>>> Caller Logon ID: - >>>>> Caller Process ID: - >>>>> Transited Services: - >>>>> Source Network Address: - >>>>> Source Port: - >>>>> >>>>> The login process is not always exactly as shown but very similar. I >>>>> suspect this is Trend because I saw this a while ago with CSM when the >>>>> Security Console was opened on the server - it generated one of these >>>>> events. >>>>> >>>>> Anyone else seen this? >>>>> >>>>> >>>> >>>> >>> >> >> > |
|
#7
25-09-2008
| |||
| |||
| Re: Trend Micro WFBS - not!
Hi Les, I didn't use domain\username but have since corrected this. Still getting the error. :( Bill "Les Connor [SBS MVP]" <les.connor@DEL.cfive.ca> wrote in message news:%23aRU2%23nHJHA.2156@TK2MSFTNGP05.phx.gbl... > it should be the fix - are you entering the username as domain\username? > > -- > Les Connor [SBS MVP] > ________________________ > Get the SBS BPA here: > http://support.microsoft.com/kb/940439/en-us > > > "Bill Glidden" <billyg1943@hotmail.com> wrote in message > news:OhKbnXdHJHA.652@TK2MSFTNGP04.phx.gbl... >> Hi Les, >> >> Tried that (mentioned in referenced thread) but no joy. Would I need to >> restart the server or any services to make this active? >> >> Bill >> >> "Les Connor [SBS MVP]" <les.connor@DEL.cfive.ca> wrote in message >> news:%23S2y1bZHJHA.3668@TK2MSFTNGP05.phx.gbl... >>> Open Trend Dashboard >>> Select preferences, Global settings >>> Select "Use a Proxy server" >>> Enter account and password. >>> >>> Should be the resolution. >>> >>> -- >>> Les Connor [SBS MVP] >>> ________________________ >>> Get the SBS BPA here: >>> http://support.microsoft.com/kb/940439/en-us >>> >>> >>> "Bill Glidden" <billyg1943@hotmail.com> wrote in message >>> news:egixbpFHJHA.1716@TK2MSFTNGP05.phx.gbl... >>>> Found this: >>>> >>>> http://www.microsoft.com/communities...r=US&sloc=&p=1 >>>> >>>> Exactly my issue - I will try some of thre solutions suggested there. >>>> >>>> "Bill Glidden" <billyg1943@hotmail.com> wrote in message >>>> news:eQI$lWFHJHA.3960@TK2MSFTNGP04.phx.gbl... >>>>> Since upgrading my CSM 3.6 to WFBS I have been getting several >>>>> thousand of these a day: >>>>> >>>>> Event Type: Failure Audit >>>>> Event Source: Security >>>>> Event Category: Logon/Logoff >>>>> Event ID: 537 >>>>> Date: 22/09/2008 >>>>> Time: 11:44:40 AM >>>>> User: NT AUTHORITY\SYSTEM >>>>> Computer: GLIDDEN-SBS2K3 >>>>> Description: >>>>> Logon Failure: >>>>> Reason: An error occurred during logon >>>>> User Name: >>>>> Domain: >>>>> Logon Type: 3 >>>>> Logon Process: Èù< >>>>> Authentication Package: NTLM >>>>> Workstation Name: >>>>> Status code: 0x80090308 >>>>> Substatus code: 0x0 >>>>> Caller User Name: - >>>>> Caller Domain: - >>>>> Caller Logon ID: - >>>>> Caller Process ID: - >>>>> Transited Services: - >>>>> Source Network Address: - >>>>> Source Port: - >>>>> >>>>> The login process is not always exactly as shown but very similar. I >>>>> suspect this is Trend because I saw this a while ago with CSM when the >>>>> Security Console was opened on the server - it generated one of these >>>>> events. >>>>> >>>>> Anyone else seen this? >>>>> >>>>> >>>> >>>> >>> >> >> > |
|
#8
25-09-2008
| |||
| |||
| Re: Trend Micro WFBS - not!
Where is the .notaccount user found? "Les Connor [SBS MVP]" <les.connor@DEL.cfive.ca> wrote in message news:uVPwFroHJHA.2156@TK2MSFTNGP05.phx.gbl... > That, and deleting the .notaccount user, is about all I can remember about > this. > > I know I don't have the error on any SBS boxes, but did; you'd think I > could remember the resolution :-(. > > -- > Les Connor [SBS MVP] > ________________________ > Get the SBS BPA here: > http://support.microsoft.com/kb/940439/en-us > > > "Les Connor [SBS MVP]" <les.connor@DEL.cfive.ca> wrote in message > news:%23aRU2%23nHJHA.2156@TK2MSFTNGP05.phx.gbl... >> it should be the fix - are you entering the username as domain\username? >> >> -- >> Les Connor [SBS MVP] >> ________________________ >> Get the SBS BPA here: >> http://support.microsoft.com/kb/940439/en-us >> >> >> "Bill Glidden" <billyg1943@hotmail.com> wrote in message >> news:OhKbnXdHJHA.652@TK2MSFTNGP04.phx.gbl... >>> Hi Les, >>> >>> Tried that (mentioned in referenced thread) but no joy. Would I need to >>> restart the server or any services to make this active? >>> >>> Bill >>> >>> "Les Connor [SBS MVP]" <les.connor@DEL.cfive.ca> wrote in message >>> news:%23S2y1bZHJHA.3668@TK2MSFTNGP05.phx.gbl... >>>> Open Trend Dashboard >>>> Select preferences, Global settings >>>> Select "Use a Proxy server" >>>> Enter account and password. >>>> >>>> Should be the resolution. >>>> >>>> -- >>>> Les Connor [SBS MVP] >>>> ________________________ >>>> Get the SBS BPA here: >>>> http://support.microsoft.com/kb/940439/en-us >>>> >>>> >>>> "Bill Glidden" <billyg1943@hotmail.com> wrote in message >>>> news:egixbpFHJHA.1716@TK2MSFTNGP05.phx.gbl... >>>>> Found this: >>>>> >>>>> http://www.microsoft.com/communities...r=US&sloc=&p=1 >>>>> >>>>> Exactly my issue - I will try some of thre solutions suggested there. >>>>> >>>>> "Bill Glidden" <billyg1943@hotmail.com> wrote in message >>>>> news:eQI$lWFHJHA.3960@TK2MSFTNGP04.phx.gbl... >>>>>> Since upgrading my CSM 3.6 to WFBS I have been getting several >>>>>> thousand of these a day: >>>>>> >>>>>> Event Type: Failure Audit >>>>>> Event Source: Security >>>>>> Event Category: Logon/Logoff >>>>>> Event ID: 537 >>>>>> Date: 22/09/2008 >>>>>> Time: 11:44:40 AM >>>>>> User: NT AUTHORITY\SYSTEM >>>>>> Computer: GLIDDEN-SBS2K3 >>>>>> Description: >>>>>> Logon Failure: >>>>>> Reason: An error occurred during logon >>>>>> User Name: >>>>>> Domain: >>>>>> Logon Type: 3 >>>>>> Logon Process: Èù< >>>>>> Authentication Package: NTLM >>>>>> Workstation Name: >>>>>> Status code: 0x80090308 >>>>>> Substatus code: 0x0 >>>>>> Caller User Name: - >>>>>> Caller Domain: - >>>>>> Caller Logon ID: - >>>>>> Caller Process ID: - >>>>>> Transited Services: - >>>>>> Source Network Address: - >>>>>> Source Port: - >>>>>> >>>>>> The login process is not always exactly as shown but very similar. I >>>>>> suspect this is Trend because I saw this a while ago with CSM when >>>>>> the Security Console was opened on the server - it generated one of >>>>>> these events. >>>>>> >>>>>> Anyone else seen this? >>>>>> >>>>>> >>>>> >>>>> >>>> >>> >>> >> > |
|
#9
25-09-2008
| |||
| |||
| Re: Trend Micro WFBS - not!
You mean the SMX_<servername> user, right? Member of the SMEX Admin Group. I would then have to do a clean install of WFBS, right? "Bill Glidden" <billyg1943@hotmail.com> wrote in message news:OADjlQpHJHA.3884@TK2MSFTNGP02.phx.gbl... > Where is the .notaccount user found? > > "Les Connor [SBS MVP]" <les.connor@DEL.cfive.ca> wrote in message > news:uVPwFroHJHA.2156@TK2MSFTNGP05.phx.gbl... >> That, and deleting the .notaccount user, is about all I can remember >> about this. >> >> I know I don't have the error on any SBS boxes, but did; you'd think I >> could remember the resolution :-(. >> >> -- >> Les Connor [SBS MVP] >> ________________________ >> Get the SBS BPA here: >> http://support.microsoft.com/kb/940439/en-us >> >> >> "Les Connor [SBS MVP]" <les.connor@DEL.cfive.ca> wrote in message >> news:%23aRU2%23nHJHA.2156@TK2MSFTNGP05.phx.gbl... >>> it should be the fix - are you entering the username as domain\username? >>> >>> -- >>> Les Connor [SBS MVP] >>> ________________________ >>> Get the SBS BPA here: >>> http://support.microsoft.com/kb/940439/en-us >>> >>> >>> "Bill Glidden" <billyg1943@hotmail.com> wrote in message >>> news:OhKbnXdHJHA.652@TK2MSFTNGP04.phx.gbl... >>>> Hi Les, >>>> >>>> Tried that (mentioned in referenced thread) but no joy. Would I need to >>>> restart the server or any services to make this active? >>>> >>>> Bill >>>> >>>> "Les Connor [SBS MVP]" <les.connor@DEL.cfive.ca> wrote in message >>>> news:%23S2y1bZHJHA.3668@TK2MSFTNGP05.phx.gbl... >>>>> Open Trend Dashboard >>>>> Select preferences, Global settings >>>>> Select "Use a Proxy server" >>>>> Enter account and password. >>>>> >>>>> Should be the resolution. >>>>> >>>>> -- >>>>> Les Connor [SBS MVP] >>>>> ________________________ >>>>> Get the SBS BPA here: >>>>> http://support.microsoft.com/kb/940439/en-us >>>>> >>>>> >>>>> "Bill Glidden" <billyg1943@hotmail.com> wrote in message >>>>> news:egixbpFHJHA.1716@TK2MSFTNGP05.phx.gbl... >>>>>> Found this: >>>>>> >>>>>> http://www.microsoft.com/communities...r=US&sloc=&p=1 >>>>>> >>>>>> Exactly my issue - I will try some of thre solutions suggested there. >>>>>> >>>>>> "Bill Glidden" <billyg1943@hotmail.com> wrote in message >>>>>> news:eQI$lWFHJHA.3960@TK2MSFTNGP04.phx.gbl... >>>>>>> Since upgrading my CSM 3.6 to WFBS I have been getting several >>>>>>> thousand of these a day: >>>>>>> >>>>>>> Event Type: Failure Audit >>>>>>> Event Source: Security >>>>>>> Event Category: Logon/Logoff >>>>>>> Event ID: 537 >>>>>>> Date: 22/09/2008 >>>>>>> Time: 11:44:40 AM >>>>>>> User: NT AUTHORITY\SYSTEM >>>>>>> Computer: GLIDDEN-SBS2K3 >>>>>>> Description: >>>>>>> Logon Failure: >>>>>>> Reason: An error occurred during logon >>>>>>> User Name: >>>>>>> Domain: >>>>>>> Logon Type: 3 >>>>>>> Logon Process: Èù< >>>>>>> Authentication Package: NTLM >>>>>>> Workstation Name: >>>>>>> Status code: 0x80090308 >>>>>>> Substatus code: 0x0 >>>>>>> Caller User Name: - >>>>>>> Caller Domain: - >>>>>>> Caller Logon ID: - >>>>>>> Caller Process ID: - >>>>>>> Transited Services: - >>>>>>> Source Network Address: - >>>>>>> Source Port: - >>>>>>> >>>>>>> The login process is not always exactly as shown but very similar. I >>>>>>> suspect this is Trend because I saw this a while ago with CSM when >>>>>>> the Security Console was opened on the server - it generated one of >>>>>>> these events. >>>>>>> >>>>>>> Anyone else seen this? >>>>>>> >>>>>>> >>>>>> >>>>>> >>>>> >>>> >>>> >>> >> > > |
|
#10
25-09-2008
| |||
| |||
| Re: Trend Micro WFBS - not!
I think I'm getting versions mixed up, sorry about that. The .notaccount is a version 3.x thingy. The only other thing I can think of is the EUQ bit - is it uninstalled? Short of calling Trend tech support (recommended), personally I'd do an uninstall and reinstall on the server, it goes fairly quickly. In add/remove, ensure all the trend stuff is uninstalled (including EUQ). -- Les Connor [SBS MVP] ________________________ Get the SBS BPA here: http://support.microsoft.com/kb/940439/en-us "Bill Glidden" <billyg1943@hotmail.com> wrote in message news:%23LODZgsHJHA.788@TK2MSFTNGP06.phx.gbl... > You mean the SMX_<servername> user, right? Member of the SMEX Admin Group. > I would then have to do a clean install of WFBS, right? > > "Bill Glidden" <billyg1943@hotmail.com> wrote in message > news:OADjlQpHJHA.3884@TK2MSFTNGP02.phx.gbl... >> Where is the .notaccount user found? >> >> "Les Connor [SBS MVP]" <les.connor@DEL.cfive.ca> wrote in message >> news:uVPwFroHJHA.2156@TK2MSFTNGP05.phx.gbl... >>> That, and deleting the .notaccount user, is about all I can remember >>> about this. >>> >>> I know I don't have the error on any SBS boxes, but did; you'd think I >>> could remember the resolution :-(. >>> >>> -- >>> Les Connor [SBS MVP] >>> ________________________ >>> Get the SBS BPA here: >>> http://support.microsoft.com/kb/940439/en-us >>> >>> >>> "Les Connor [SBS MVP]" <les.connor@DEL.cfive.ca> wrote in message >>> news:%23aRU2%23nHJHA.2156@TK2MSFTNGP05.phx.gbl... >>>> it should be the fix - are you entering the username as >>>> domain\username? >>>> >>>> -- >>>> Les Connor [SBS MVP] >>>> ________________________ >>>> Get the SBS BPA here: >>>> http://support.microsoft.com/kb/940439/en-us >>>> >>>> >>>> "Bill Glidden" <billyg1943@hotmail.com> wrote in message >>>> news:OhKbnXdHJHA.652@TK2MSFTNGP04.phx.gbl... >>>>> Hi Les, >>>>> >>>>> Tried that (mentioned in referenced thread) but no joy. Would I need >>>>> to restart the server or any services to make this active? >>>>> >>>>> Bill >>>>> >>>>> "Les Connor [SBS MVP]" <les.connor@DEL.cfive.ca> wrote in message >>>>> news:%23S2y1bZHJHA.3668@TK2MSFTNGP05.phx.gbl... >>>>>> Open Trend Dashboard >>>>>> Select preferences, Global settings >>>>>> Select "Use a Proxy server" >>>>>> Enter account and password. >>>>>> >>>>>> Should be the resolution. >>>>>> >>>>>> -- >>>>>> Les Connor [SBS MVP] >>>>>> ________________________ >>>>>> Get the SBS BPA here: >>>>>> http://support.microsoft.com/kb/940439/en-us >>>>>> >>>>>> >>>>>> "Bill Glidden" <billyg1943@hotmail.com> wrote in message >>>>>> news:egixbpFHJHA.1716@TK2MSFTNGP05.phx.gbl... >>>>>>> Found this: >>>>>>> >>>>>>> http://www.microsoft.com/communities...r=US&sloc=&p=1 >>>>>>> >>>>>>> Exactly my issue - I will try some of thre solutions suggested >>>>>>> there. >>>>>>> >>>>>>> "Bill Glidden" <billyg1943@hotmail.com> wrote in message >>>>>>> news:eQI$lWFHJHA.3960@TK2MSFTNGP04.phx.gbl... >>>>>>>> Since upgrading my CSM 3.6 to WFBS I have been getting several >>>>>>>> thousand of these a day: >>>>>>>> >>>>>>>> Event Type: Failure Audit >>>>>>>> Event Source: Security >>>>>>>> Event Category: Logon/Logoff >>>>>>>> Event ID: 537 >>>>>>>> Date: 22/09/2008 >>>>>>>> Time: 11:44:40 AM >>>>>>>> User: NT AUTHORITY\SYSTEM >>>>>>>> Computer: GLIDDEN-SBS2K3 >>>>>>>> Description: >>>>>>>> Logon Failure: >>>>>>>> Reason: An error occurred during logon >>>>>>>> User Name: >>>>>>>> Domain: >>>>>>>> Logon Type: 3 >>>>>>>> Logon Process: Èù< >>>>>>>> Authentication Package: NTLM >>>>>>>> Workstation Name: >>>>>>>> Status code: 0x80090308 >>>>>>>> Substatus code: 0x0 >>>>>>>> Caller User Name: - >>>>>>>> Caller Domain: - >>>>>>>> Caller Logon ID: - >>>>>>>> Caller Process ID: - >>>>>>>> Transited Services: - >>>>>>>> Source Network Address: - >>>>>>>> Source Port: - >>>>>>>> >>>>>>>> The login process is not always exactly as shown but very similar. >>>>>>>> I suspect this is Trend because I saw this a while ago with CSM >>>>>>>> when the Security Console was opened on the server - it generated >>>>>>>> one of these events. >>>>>>>> >>>>>>>> Anyone else seen this? >>>>>>>> >>>>>>>> >>>>>>> >>>>>>> >>>>>> >>>>> >>>>> >>>> >>> >> >> > > |
|
|
| Thread Tools | Search this Thread |
| |
Similar Threads for: "Trend Micro WFBS - not!" | ||||
| Thread | Thread Starter | Forum | Replies | Last Post |
| SPAMfighter or Trend Micro | Lankesh | Networking & Security | 5 | 21-01-2010 12:17 AM |
| Trend WFBS upgrade 5.1 --> 6 | MM | Small Business Server | 12 | 27-11-2009 05:23 AM |
| Trend micro installation's problem | Vikash kumar Singh | Small Business Server | 1 | 21-11-2009 11:19 PM |
| Trend micro vs AVG | Taipai | Networking & Security | 3 | 01-07-2009 12:58 PM |
| Trend Micro Supports Windows 7 | Damiano | Web News & Trends | 0 | 21-04-2009 12:42 AM |
