Failure Audit - Logon/Logoff - Event ID 529

[Actionguy]

I have got Windows Server 2003 which is working as a Web server that is inside an intranet which shows a growing number of failure audits which is mentioned below:

Event Type: Failure Audit
Event Source: Security
Event Category: Logon/Logoff
Event ID: 529
Date: 1/1/2009
Time: 9:32:44 AM
User: NT AUTHORITY\SYSTEM
Computer: MYSERVER
Description:
Logon Failure:
Reason: Unknown user name or bad password
User Name:
Domain: WORKGROUP
Logon Type: 3
Logon Process: NtLmSsp
Authentication Package: NTLM
Workstation Name: lQPxd6fSQgERESGK
Caller User Name: -
Caller Domain: -
Caller Logon ID: -
Caller Process ID: -
Transited Services: -
Source Network Address: 321.32.321.32
Source Port: 0

I want to know what is the meaning of Domain: Workgroup, what does it do? Also what does the meaningless worstation refer to? I also want to know why username is blank? Any help would be appreciated.

[manishdk]

First of all Type 3 is normally a network or IIS logon and it is over NTLM. The domain thing means that the client is in a workgroup. Third question that yo asked is about the client name and the next answer is that there is no usernam supplied. What you need to ask I think is that how come a client on a network getting access to your intranet IIS?

[karrma]

I think that you need to create SPNs for some custom services running on member servers of the domain, disabled Kerberos logging and now these errors are gone. You can try to get some more refrence from this website - http://technet.microsoft.com/en-us/l...=ws.10%29.aspx