For the past three days I have been getting event id 50.
I have read the Microsoft KB article about it and I plan on following their troubleshooting steps.
What concerns me though is that on each day it appeared it was around ten times in a row, one or two seconds apart.
To me this makes me think some rogue computer outside our network is trying to log in remotely.
Has anyone here noticed something similar? Any suggestions?
Additional info: this started happening after I gave an outside client an RDP icon on their desktop to log in to one of our servers.
(also, this pc had just been returned from a ‘hole in the wall’ pc repair shop; the client said they ‘messed up’ the computer instead of fixing it)
When I went to ‘start-run..’ and launched ‘mstsc’ (remote desktop), the IP address field was autofilled with someone else’s public IP address.
When I asked the client if they had any IT people that came in for anything, they said ‘no’.
So I wonder if this machine is compromised somehow and is loaded with some kind of bot that could be trying to hit our server through RDP.