Hi,
I got a wind2k server which is a not a domain controller .Almost all the clients are XP .
I can see most of the time it shows in the security log showing login/logoff attempt fail and the machine which attempeted is my local clients.
Checked that it is problem with XP clients and hence it may attempt like that and hence i felt that it is not a issue …
recently i can see the same attempts happen but the time is midnight where no one will be in the office and also the machine name is different and the domain which it is trying to connect is also different …
I can see this only happens when no one is in the office ,thatis early morning or midnight and also these machines are not in my network
I have given the logfile below
Please help me since i’m very much confused abt this
========
Event Type: Failure Audit
Event Source: Security
Event Category: Logon/Logoff
Event ID: 529
Date: 10/9/2003
Time: 2:22:06 AM
User: NT AUTHORITY\SYSTEM
Computer: MYMACHINE
Description:
Logon Failure:
Reason: Unknown user name or bad password
User Name: Administrator
Domain: RSPMEXICO
Logon Type: 3
Logon Process: NtLmSsp
Authentication Package: NTLM
Workstation Name: CTRLDOCS10
=====================
Event Type: Failure Audit
Event Source: Security
Event Category: Account Logon
Event ID: 681
Date: 10/21/2003
Time: 2:11:45 AM
User: NT AUTHORITY\SYSTEM
Computer: MYMACHINE
Description:
The logon to account: Owner
by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
from workstation: PC-MODEM
failed. The error code was: 3221225572
===================
Description:
Logon Failure:
Reason: Unknown user name or bad password
User Name: Administrator
Domain: 209594-R9HA821
Logon Type: 3
Logon Process: NtLmSsp
Authentication Package: NTLM
Workstation Name: 209594-R9HA821
MYMACHINE is my server in the network
these machines are not in my network and why it happens during the midnight