Weird 529 Error
|
From: GX on 24 Jun 2010 14:05 Ok...so I used to have this user setup on this SBS2003 server. The user is gone and removed from the Users on the server. His profile is deleted from the server, there are no services attached to his account, and no registry keys with his username in it. Now, everyday I get this error at the same time.... How can I find this user on the server and get rid of it???? Event Type: Failure Audit Event Source: Security Event Category: Logon/Logoff Event ID: 529 Date: 6/24/2010 Time: 11:15:16 AM User: NT AUTHORITY\SYSTEM Computer: SERVERNAME Description: Logon Failure: Reason: Unknown user name or bad password User Name: treibling Domain: servername Logon Type: 3 Logon Process: NtLmSsp Authentication Package: NTLM Workstation Name: SERVERNAME Caller User Name: - Caller Domain: - Caller Logon ID: - Caller Process ID: - Transited Services: - Source Network Address: - Source Port: - For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
From: Russ (SBITS.Biz) [SBS-MVP] on 25 Jun 2010 18:59 See if this helps http://support.microsoft.com/kb/811082 Russ -- For Future SBS Related Questions Please post to http://social.technet.microsoft.com/Forums/en-US/smallbusinessserver/threads Or use the easy to remember http://www.SBSRepair.com (Redirect) ------- Russell Grover - SBITS.Biz [SBS-MVP] MCP, MCPS, MCNPS, SBSC Remote Small Business Server/Computer Support - www.SBITS.Biz BPOS - Microsoft Online Services - www.BPOSMadeEasy.com "GX" <GX(a)discussions.microsoft.com> wrote in message news:948E35CC-8CA4-45D8-9801-FDF9467AD22B(a)microsoft.com... > Ok...so I used to have this user setup on this SBS2003 server. The user is > gone and removed from the Users on the server. His profile is deleted from > the server, there are no services attached to his account, and no registry > keys with his username in it. Now, everyday I get this error at the same > time.... > > How can I find this user on the server and get rid of it???? > > Event Type: Failure Audit > Event Source: Security > Event Category: Logon/Logoff > Event ID: 529 > Date: 6/24/2010 > Time: 11:15:16 AM > User: NT AUTHORITY\SYSTEM > Computer: SERVERNAME > Description: > Logon Failure: > Reason: Unknown user name or bad password > User Name: treibling > Domain: servername > Logon Type: 3 > Logon Process: NtLmSsp > Authentication Package: NTLM > Workstation Name: SERVERNAME > Caller User Name: - > Caller Domain: - > Caller Logon ID: - > Caller Process ID: - > Transited Services: - > Source Network Address: - > Source Port: - > > > For more information, see Help and Support Center at > http://go.microsoft.com/fwlink/events.asp. >
From: Bill Sanderson on 25 Jun 2010 21:31 Checked for scheduled tasks at the time the error is generated? "GX" wrote in message news:948E35CC-8CA4-45D8-9801-FDF9467AD22B(a)microsoft.com... Ok...so I used to have this user setup on this SBS2003 server. The user is gone and removed from the Users on the server. His profile is deleted from the server, there are no services attached to his account, and no registry keys with his username in it. Now, everyday I get this error at the same time.... How can I find this user on the server and get rid of it???? Event Type: Failure Audit Event Source: Security Event Category: Logon/Logoff Event ID: 529 Date: 6/24/2010 Time: 11:15:16 AM User: NT AUTHORITY\SYSTEM Computer: SERVERNAME Description: Logon Failure: Reason: Unknown user name or bad password User Name: treibling Domain: servername Logon Type: 3 Logon Process: NtLmSsp Authentication Package: NTLM Workstation Name: SERVERNAME Caller User Name: - Caller Domain: - Caller Logon ID: - Caller Process ID: - Transited Services: - Source Network Address: - Source Port: - For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
From: GX on 28 Jun 2010 07:36 Russ - this is happening on the server itself, the server is the DC (SBS2003) with 8 computers connecting to it. Bill - nothing running on the sched. task.... :( any other suggestions as to how to find traces of a user that has been deleted??? "Bill Sanderson" wrote: > Checked for scheduled tasks at the time the error is generated? > > "GX" wrote in message > news:948E35CC-8CA4-45D8-9801-FDF9467AD22B(a)microsoft.com... > > Ok...so I used to have this user setup on this SBS2003 server. The user is > gone and removed from the Users on the server. His profile is deleted from > the server, there are no services attached to his account, and no registry > keys with his username in it. Now, everyday I get this error at the same > time.... > > How can I find this user on the server and get rid of it???? > > Event Type: Failure Audit > Event Source: Security > Event Category: Logon/Logoff > Event ID: 529 > Date: 6/24/2010 > Time: 11:15:16 AM > User: NT AUTHORITY\SYSTEM > Computer: SERVERNAME > Description: > Logon Failure: > Reason: Unknown user name or bad password > User Name: treibling > Domain: servername > Logon Type: 3 > Logon Process: NtLmSsp > Authentication Package: NTLM > Workstation Name: SERVERNAME > Caller User Name: - > Caller Domain: - > Caller Logon ID: - > Caller Process ID: - > Transited Services: - > Source Network Address: - > Source Port: - > > > For more information, see Help and Support Center at > http://go.microsoft.com/fwlink/events.asp. > > . >
From: Russ (SBITS.Biz) [SBS-MVP] on 28 Jun 2010 22:42
What Bill means (If I may) That it sounds like a "Scheduled" Service that is running, but Failing, because the password is wrong. (That What I think he means) Russ -- Russell Grover - SBITS.Biz [SBS-MVP] MCP, MCPS, MCNPS, SBSC Remote Small Business Server/Computer Support - www.SBITS.Biz BPOS - Microsoft Online Services - www.BPOSMadeEasy.com Easy Redirect to Microsoft's New SBS Public Forum - www.SBSRepair.com "GX" <GX(a)discussions.microsoft.com> wrote in message news:B73C3883-D2E0-4AB4-A120-AAE8E6AF59EE(a)microsoft.com... > Russ - this is happening on the server itself, the server is the DC > (SBS2003) > with 8 computers connecting to it. > Bill - nothing running on the sched. task.... :( > > any other suggestions as to how to find traces of a user that has been > deleted??? > > "Bill Sanderson" wrote: > >> Checked for scheduled tasks at the time the error is generated? >> >> "GX" wrote in message >> news:948E35CC-8CA4-45D8-9801-FDF9467AD22B(a)microsoft.com... >> >> Ok...so I used to have this user setup on this SBS2003 server. The user >> is >> gone and removed from the Users on the server. His profile is deleted >> from >> the server, there are no services attached to his account, and no >> registry >> keys with his username in it. Now, everyday I get this error at the same >> time.... >> >> How can I find this user on the server and get rid of it???? >> >> Event Type: Failure Audit >> Event Source: Security >> Event Category: Logon/Logoff >> Event ID: 529 >> Date: 6/24/2010 >> Time: 11:15:16 AM >> User: NT AUTHORITY\SYSTEM >> Computer: SERVERNAME >> Description: >> Logon Failure: >> Reason: Unknown user name or bad password >> User Name: treibling >> Domain: servername >> Logon Type: 3 >> Logon Process: NtLmSsp >> Authentication Package: NTLM >> Workstation Name: SERVERNAME >> Caller User Name: - >> Caller Domain: - >> Caller Logon ID: - >> Caller Process ID: - >> Transited Services: - >> Source Network Address: - >> Source Port: - >> >> >> For more information, see Help and Support Center at >> http://go.microsoft.com/fwlink/events.asp. >> >> . >> |