Tryingto trace an unauthorized login

[mAD!dOX]

Sponsored Links

Since last two days I am getting notification of unauthorized login attempt on my system. I tried to find out its details under Firewall but there is no info about the same. This is the complete message:

I'm getting an Event ID of 529
The USER is listed as NT AUTHORITY/SYSTEM

Logon Failure:
Reason: Unknown user name or bad password
User Name: anna
Domain:
Logon Type: 3
Logon Process: Advapi
Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Workstation Name: JM-APPSERVER
Caller User Name: JM-APPSERVER$
Caller Domain: JACKSMAGIC
Caller Logon ID: (0x0,0x3E7)
Caller Process ID: 5128
Transited Services: -
Source Network Address: -
Source Port: -

Any idea?

[Katherina]

As your error states “Caller Process ID: 5128”, can you just tell me which process on your server has PID 5128? Till then just remember that there is nothing to worry about it as it is just a failed login attempt.

[Vitaly]

Hey friend, I’m also facing the problem on SBS 2003 server. I found more than 10000 events. Some of them are :

Event ID 529
Last Occurrence 11/4/2008 5:46 AM
Total Occurrences 13,687
Logon Failure:
Reason: Unknown user name or bad password
User Name: mike
Domain:
Logon Type: 3
Logon Process: Advapi
Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Workstation Name: DC0
Caller User Name: DC0$
Caller Domain: RU
Caller Logon ID: (0x0,0x3E7)
Caller Process ID: 2052
Transited Services: -
Source Network Address: -
Source Port: -