Security

Ask something
Question Locked

Stray user account....

0 helpful
8 replies

by downrighttired

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

A while back I began having problems with an administrative account in W2k3 that I used for things like running backups. I ended up having to delete the user and reset all the services that used the account. At least i thought I did....

Looking at my security events Im noticing failed logon events about once an hour referencing the deleted account. THeres actually about 40 failed logons logged every hour. The 40 events all have the same timestamp to the second. The events consist of event id 529, then 680, then 672 twice. This series repeats 4 times per hour. hope that makes sense.
So I guess basically my question is how can I find out whats trying to use the deleted account? I dont get any clues from the events, unless Im missing something? Any help or ideas would be appreciated...

8 replies

by ic-it

Likely the account credentials were entered into your backup program or an automated task.

by downrighttired

..but the only tasks Ive ever scheduled on the DC were windows backup events, all of which Ive switched to the new account.
Also Im certain that I never set anything to run on an hourly basis. Im thinking it has to be some old application or some service our website uses, although I havnt noticed any failed functionality in it (or anything else for that matter).
Is there some method or application out there which will allow me list what applications or processes are using what accounts?

by ic-it

If security is enabled the logs may tell you the machine name that the "rogue" user is being run from.

by fred123456

I'm wondering if you setup some Scheduled Tasks using the old account.

But check out these links to the specific errors. The explanation of why these errors are posted to the event viewer may get you pointed in the right direction.

The 529 error is exaplained as
"When a user logs off, Windows XP or Windows Server 2003 re-reads the user record for updated information to optimize the next logon process. However, Windows ignores the fact that the user is from the local SAM database and instead tries to contact the domain if the computer is a member of a domain."

Perhaps its a local account?

529
http://support.microsoft.com/kb/811082

680
http://www.ultimatewindowssecurity.com/events/com304.html

672
http://www.ultimatewindowssecurity.com/events/com293.html

by downrighttired

Well Ive checked all the scheduled tasks, the only ones I have are backup tasks, all of which Ive switched to the new account.
The events are occuring on the DC itself, and they show that the account which failed is the old account I was using, and I know it was never set as a local account. Thanks for the links though, never checked that site out...

by downrighttired

Ok so I finally figured this one out. It was related to scheduled backups. I had went and changed the user that the backup process was running as, but I never deleted the old user folder on the servers. So while the backups where running AS the right user the schedules themselves where scheduled under the old user.

by downrighttired

Well thats actually the only reason I noticed it at all, was when i was scanning through event logs. the logged failed audits tell me only 2 things (as far as I know) the user and the computer. It shows the events as coming from the DC itself. Ive gone through every running service I can think of and cant find whats using the account....

This discussion is closed to new replies.