Logon type 3 - ID 529

[Ruthe]

I’m in need of some urgent help. I’m running SBS 2003 with few client workstations including Xp as well as Vista computers. Since past few hours, for the first time, I received about 80 failed security login alerts from 3 of the Vista based computers. Surprisingly, 1 out of these 3 computers was shutdown for the entire day today, then how I got the alert from that system?

Here is the complete error detail:
Event ID: 529
Logon Failure:
Reason: Uknown user name or bad password
Domain: companydomain
Logon Type: 3
Logon Process: NtLmSsp
Authentication Package: NTLM
Workstation Name: VISTAMACHINE

All other fields are blank including 'User Name'

Please provide your advices. Thank you.

[maratha]

First of all check the workstations from where you received the alert. See if there is any app/security/system logs corresponding to the same time as the server log? Also I would like to know whether those Vista systems are running with Service Pack 1?

[Ruthe]

Thanks for your help Maratha. I checked those workstations, there is nothing in the log. Also there is no service pack installed on any of these Vista systems. Only thing I noticed at the same time as an alert this morning was:

The time provider NtpClient is currently receiving valid data from server.domain.local (ntp.d|0.0.0.0:123->serverip:123).

Is it harmful

[NavinS]

Most probably I think the problem would occurred if those machines’ password is not properly sync. I think you need to go through the following steps to reset domain controller username and password:

ETDOM RESETPWD /Server:ServerName /UsedD:Administrator /PasswordD:*

After that, please restart the server.