Monday, December 10, 2012 9:24 AM
I changed the Admin password on the Server I managed. Changed it through the Change Password on the Crt-Alt-Del screen.
Since then I have been getting the following error message in the event log, about 100 times per day every 30 minutes. The only difference is that the source port is never the same. I have restarted the Server several times, but makes no difference.
I have banked out the User Name and Domain.
I am running SBS2003 with SP2 and all updates applied.
Event Type: Failure Audit
Event Source: Security
Event Category: Logon/Logoff
Event ID: 529
User: NT AUTHORITY\SYSTEM
Reason: Unknown user name or bad password
User Name: XXXXXXXX
Logon Type: 3
Logon Process: Advapi
Authentication Package: Negotiate
Workstation Name: SERVER
Caller User Name: SERVER$
Caller Domain: BANCUMM
Caller Logon ID: (0x0,0x3E7)
Caller Process ID: 468
Transited Services: -
Source Network Address: 192.168.16.2
Source Port: 49285
Monday, December 10, 2012 11:02 AM
Did a quick Google search on Event ID 529 and it turned up these...any use?
Monday, December 10, 2012 1:54 PM
Open the thread refer some thread links on right hand side as shown , you will find the answer.
- Edited by MohitkapoorMicrosoft Community Contributor Monday, December 10, 2012 1:56 PM
Wednesday, December 12, 2012 6:05 AMModerator
Based on my research, the following two articles provided related troubleshooting process which might be helpful for you:
Unknown username or bad password - InetInfo.exe – ADVAPI
Using Local Accounts to Access Network Resources on Domain Computers
Maybe a script or scheduled task is running where you didn't change the password?
Also conficker Virus can be a reason: http://support.microsoft.com/kb/962007
If the above doesn't help use the Account lockout tools:
TechNet Community Support
- Marked As Answer by Yan Li_Microsoft Contingent Staff, Moderator Monday, December 17, 2012 2:06 AM