Discussion Locked

strange log file in eventviewer

0 helpful
2 replies
Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Hi,
I got a wind2k server which is a not a domain controller .Almost all the clients are XP .
I can see most of the time it shows in the security log showing login/logoff attempt fail and the machine which attempeted is my local clients.
Checked that it is problem with XP clients and hence it may attempt like that and hence i felt that it is not a issue ...
recently i can see the same attempts happen but the time is midnight where no one will be in the office and also the machine name is different and the domain which it is trying to connect is also different ...
I can see this only happens when no one is in the office ,thatis early morning or midnight and also these machines are not in my network
I have given the logfile below
Please help me since i'm very much confused abt this
========
Event Type: Failure Audit
Event Source: Security
Event Category: Logon/Logoff
Event ID: 529
Date: 10/9/2003
Time: 2:22:06 AM
User: NT AUTHORITY\SYSTEM
Computer: MYMACHINE
Description:
Logon Failure:
Reason: Unknown user name or bad password
User Name: Administrator
Domain: RSPMEXICO
Logon Type: 3
Logon Process: NtLmSsp
Authentication Package: NTLM
Workstation Name: CTRLDOCS10
=====================
Event Type: Failure Audit
Event Source: Security
Event Category: Account Logon
Event ID: 681
Date: 10/21/2003
Time: 2:11:45 AM
User: NT AUTHORITY\SYSTEM
Computer: MYMACHINE
Description:
The logon to account: Owner
by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
from workstation: PC-MODEM
failed. The error code was: 3221225572
===================
Description:
Logon Failure:
Reason: Unknown user name or bad password
User Name: Administrator
Domain: 209594-R9HA821
Logon Type: 3
Logon Process: NtLmSsp
Authentication Package: NTLM
Workstation Name: 209594-R9HA821

MYMACHINE is my server in the network
these machines are not in my network and why it happens during the midnight

2 replies

by trackme

I have a well secured firewall (I think :))!!!!!!
The issue comes with the local clients also and i see both the local and remote machines log the same event number ,type etc.
I have scanned and also checked for trojans,already the ports 139,135 and other netbios ports are blocked in the firewall ...
and some times one more thing is that my firewall log shows my machine attempting to connect to some site and the same is blocked ...At this time no was using my machine ..Strange again .....

please help.

This discussion is closed to new replies.