Security log event ID 529 & System log event ID 10004

[Paul]

The security log on my customer's SBS 2003 server is getting a 529 error thousands of times per day. This error started when all the user passwords were expired in order to force an immediate password change. There are also no services starting with this valid username, actually the user listed in the top section of the error details screen is NT Authority\System. Check the below failure audit details:

Logon Failure:
Reason: Unknown user name or bad password
User Name: <valid active user name>
Domain: <my domain>
Logon Type: 4
Logon Process: DCOMSCM
Authentication Package: Negotiate
Workstation Name: SBS1
Caller User Name: SBS1$
Caller Domain: FCPC

I think that the DCOMSCM is a SQL tool but I am not sure what application is calling it. Also, the System log shows a similar kind of error 10004 at the same time, check below:

DCOM got error "Logon failure: unknown user name or bad password. " and was unable to logon .\<valid user name> in order to run the server: {92CF31D6-E904-4EE8-AAC9-E1A7719056E9}

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

Can anyone help me out?

[Anywhere]

You can try to perform advanced clean-boot troubleshooting to determine whether the problem in question is affiliated with the core operating system or with a program that is loading in the Windows environment. For more information about how to clean boot your computer, click the following article here - http://support.microsoft.com/kb/316434

[kk dd]

Hi There

I have the foloowing error messages on my SMB server 2003. Please advise how can i fix the issue.

Logon Failure:


Reason:
Unknown user name or bad password


User Name:
marks


Domain:



Logon Type:
3


Logon Process:
Advapi


Authentication Package:
MICROSOFT_AUTHENTICATION_PACKAGE_V1_0


Workstation Name:
3DBCSVR01


Caller User Name:
3DBCSVR01$


Caller Domain:
3DBC


Caller Logon ID:
(0x0,0x3E7)


Caller Process ID:
1956


Transited Services:
-


Source Network Address:
-


Source Port:
-