Weird 529 Error
|
From: Bill Sanderson on 29 Jun 2010 11:20 Well, you definitely clarified what I meant! Service or not, I believe these are all run by the same scheduler--perhaps going to (options??) and showing hidden tasks? (Sorry, don't have s 2k3 handy to get the exact syntax) It would be an uncommon server not to have any scheduled tasks. OK --Explore Scheduled Tasks. Advanced check the AT Service account, which should be System Account, but you never know... Turn on "View hidden tasks" If you spot one that corresponds to the correct time, right click, choose properties, and look at the Run As information View Log might have relevant information as well. Specific services can have their own credentials set as well - check the "log on as" column in services.msc. "Russ (SBITS.Biz) [SBS-MVP]" wrote in message news:D9173CFC-3CA2-48F8-AA80-1F8CE0710142(a)microsoft.com... What Bill means (If I may) That it sounds like a "Scheduled" Service that is running, but Failing, because the password is wrong. (That What I think he means) Russ -- Russell Grover - SBITS.Biz [SBS-MVP] MCP, MCPS, MCNPS, SBSC Remote Small Business Server/Computer Support - www.SBITS.Biz BPOS - Microsoft Online Services - www.BPOSMadeEasy.com Easy Redirect to Microsoft's New SBS Public Forum - www.SBSRepair.com "GX" <GX(a)discussions.microsoft.com> wrote in message news:B73C3883-D2E0-4AB4-A120-AAE8E6AF59EE(a)microsoft.com... > Russ - this is happening on the server itself, the server is the DC > (SBS2003) > with 8 computers connecting to it. > Bill - nothing running on the sched. task.... :( > > any other suggestions as to how to find traces of a user that has been > deleted??? > > "Bill Sanderson" wrote: > >> Checked for scheduled tasks at the time the error is generated? >> >> "GX" wrote in message >> news:948E35CC-8CA4-45D8-9801-FDF9467AD22B(a)microsoft.com... >> >> Ok...so I used to have this user setup on this SBS2003 server. The user >> is >> gone and removed from the Users on the server. His profile is deleted >> from >> the server, there are no services attached to his account, and no >> registry >> keys with his username in it. Now, everyday I get this error at the same >> time.... >> >> How can I find this user on the server and get rid of it???? >> >> Event Type: Failure Audit >> Event Source: Security >> Event Category: Logon/Logoff >> Event ID: 529 >> Date: 6/24/2010 >> Time: 11:15:16 AM >> User: NT AUTHORITY\SYSTEM >> Computer: SERVERNAME >> Description: >> Logon Failure: >> Reason: Unknown user name or bad password >> User Name: treibling >> Domain: servername >> Logon Type: 3 >> Logon Process: NtLmSsp >> Authentication Package: NTLM >> Workstation Name: SERVERNAME >> Caller User Name: - >> Caller Domain: - >> Caller Logon ID: - >> Caller Process ID: - >> Transited Services: - >> Source Network Address: - >> Source Port: - >> >> >> For more information, see Help and Support Center at >> http://go.microsoft.com/fwlink/events.asp. >> >> . >> |