Results 1 to 3 of 3

Thread: Failure Audit - Logon/Logoff - Event ID 529

  1. #1
    Join Date
    Nov 2005
    Posts
    625

    Failure Audit - Logon/Logoff - Event ID 529

    I have got Windows Server 2003 which is working as a Web server that is inside an intranet which shows a growing number of failure audits which is mentioned below:

    Event Type: Failure Audit
    Event Source: Security
    Event Category: Logon/Logoff
    Event ID: 529
    Date: 1/1/2009
    Time: 9:32:44 AM
    User: NT AUTHORITY\SYSTEM
    Computer: MYSERVER
    Description:
    Logon Failure:
    Reason: Unknown user name or bad password
    User Name:
    Domain: WORKGROUP
    Logon Type: 3
    Logon Process: NtLmSsp
    Authentication Package: NTLM
    Workstation Name: lQPxd6fSQgERESGK
    Caller User Name: -
    Caller Domain: -
    Caller Logon ID: -
    Caller Process ID: -
    Transited Services: -
    Source Network Address: 321.32.321.32
    Source Port: 0

    I want to know what is the meaning of Domain: Workgroup, what does it do? Also what does the meaningless worstation refer to? I also want to know why username is blank? Any help would be appreciated.

  2. #2
    Join Date
    Jul 2004
    Posts
    153

    Re: Failure Audit - Logon/Logoff - Event ID 529

    First of all Type 3 is normally a network or IIS logon and it is over NTLM. The domain thing means that the client is in a workgroup. Third question that yo asked is about the client name and the next answer is that there is no usernam supplied. What you need to ask I think is that how come a client on a network getting access to your intranet IIS?

  3. #3
    Join Date
    Sep 2005
    Posts
    156
    I think that you need to create SPNs for some custom services running on member servers of the domain, disabled Kerberos logging and now these errors are gone. You can try to get some more refrence from this website - http://technet.microsoft.com/en-us/l...=ws.10%29.aspx

Similar Threads

  1. Replies: 5
    Last Post: 28-10-2010, 07:23 PM
  2. Security Failure Audit Account Logon Event ID 675
    By Itsme in forum Active Directory
    Replies: 1
    Last Post: 01-06-2009, 05:53 PM
  3. Replies: 4
    Last Post: 20-11-2008, 01:13 AM
  4. Immediate logoff after logon
    By skitzsofrenick in forum Windows Server Help
    Replies: 4
    Last Post: 18-06-2008, 08:12 AM
  5. event: 566 Object Access Audit Failure
    By maratha in forum Active Directory
    Replies: 1
    Last Post: 14-02-2008, 05:04 PM

Tags for this Thread

Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •  
Page generated in 1,721,290,609.84679 seconds with 17 queries