The security log on my customer's SBS 2003 server is getting a 529 error thousands of times per day. This error started when all the user passwords were expired in order to force an immediate password change. There are also no services starting with this valid username, actually the user listed in the top section of the error details screen is NT Authority\System. Check the below failure audit details:
Logon Failure:
Reason: Unknown user name or bad password
User Name: <valid active user name>
Domain: <my domain>
Logon Type: 4
Logon Process: DCOMSCM
Authentication Package: Negotiate
Workstation Name: SBS1
Caller User Name: SBS1$
Caller Domain: FCPC
I think that the DCOMSCM is a SQL tool but I am not sure what application is calling it. Also, the System log shows a similar kind of error 10004 at the same time, check below:
DCOM got error "Logon failure: unknown user name or bad password. " and was unable to logon .\<valid user name> in order to run the server: {92CF31D6-E904-4EE8-AAC9-E1A7719056E9}
For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Can anyone help me out?
Bookmarks