My Server is trying to log into itself
Page 1 of 4 123 ... LastLast
Results 1 to 10 of 34

Thread: My Server is trying to log into itself

  1. #1
    Junior Member
    Join Date
    Jul 2006
    Posts
    14

    My Server is trying to log into itself

    Ok, I've searched through more websites then I care to admit regarding this issue and have tried everything short of a reinstall. I'm running a m$ Small Business Server 2k3 w/ sp1 and I am getting 4 failure audits every other minute (like clockwork), It appears that my server machine is trying to log into the domain and failing, everything is working fine but I have no idea how to fix this. Just incase it helps here is the event listing:

    Event Type: Failure Audit
    Event Source: Security
    Event Category: Logon/Logoff
    Event ID: 529
    Date: 7/12/2006
    Time: 7:12:38 AM
    User: NT AUTHORITY\SYSTEM
    Computer: SERVER-SBS
    Description:
    Logon Failure:
    Reason: Unknown user name or bad password
    User Name: SERVER-SBS$
    Domain: LOCALDOMAIN
    Logon Type: 3
    Logon Process: NtLmSsp
    Authentication Package: NTLM
    Workstation Name: SERVER-SBS

    As for its regularity, its 4 failure audits (all within 1-2 seconds) every other minute, regardless of any client systems being on or off.

    I'm getting tired of banging my head on the wall over this issue so I am hoping that someone here could possibly give me some insight on at least where to go to resolve this error.

  2. #2
    AOs Resident Troll
    Join Date
    Nov 2003
    Posts
    3,152
    Well...MS offers support for 245.00 USD....per incident

    Alot less of a cost then a reinstall of a server.....

    Now...what 3rd party applications do you run on this server?? AV etc

    Is this standard or premium sbs???

    Do you have a firewall??

    Do you have any remote services activated???

    When did this start to happen???

    How old is the install???

    MLF

    edit>

    Did you change the admin account\password???

    here is a great resource....http://www.microsoft.com/technet/com...ows.server.sbs

    and a search on this group turned up this

    http://www.microsoft.com/technet/com...xp=&sloc=en-us
    How people treat you is their karma- how you react is yours-Wayne Dyer

  3. #3
    Junior Member
    Join Date
    Jul 2006
    Posts
    14
    Well as for the 3rd party software I have MacAfeeís Total Protection for Small Business (trial account), and I have our accounting software host running as a service (MAS 90/200). Itís just the standard edition of sbs and I only installed it about a month and a half ago, I noticed these issues about a month ago. The only firewall that I am running is from my rougher.

  4. #4
    AOs Resident Troll
    Join Date
    Nov 2003
    Posts
    3,152
    Not sure if you saw my edit

    Did you change the admin password or account???

    Do you have any services\ports open on the router?? OWA, VPN,Remote Workplace????

    MLF
    How people treat you is their karma- how you react is yours-Wayne Dyer

  5. #5
    Junior Member
    Join Date
    Jul 2006
    Posts
    14
    Sorry no I didnít see the edit but I have changed the admin password but the account name is still Administrator. As for the router I do have some ports open so we can have our OS/400 guy can get in to access what he needs on that system, to save some time on that issue I have tried to narrow the search by unplugging the network (off hours) and the failure audits were still happening.

  6. #6
    AOs Resident Troll
    Join Date
    Nov 2003
    Posts
    3,152
    OK...when you changed the admin password...did you reset it for all services...because that is what is happening...

    Any errors in the system or application event logs.....that should point to what is failing

    What you need to do is reset the password on all services\applications that use the administrator password to run.

    Its probably your MacAffee ...gut feeling

    MLF
    How people treat you is their karma- how you react is yours-Wayne Dyer

  7. #7
    Junior Member
    Join Date
    Jul 2006
    Posts
    14
    Alright I checked my services and I didnt see anything except, local service, local system, network service, and nt authority\network service. After checking my system & application event logs I did find that I was having errors with SQLAgent$SBSMONITORING, I stopped that service (wich should stop any of it's login attempts right?) and am still getting the same failure audits. I checked my McAfee and its logged in under local system.
    There are 10 types of people in this world, those who understand binary, and those who donít.

  8. #8
    AOs Resident Troll
    Join Date
    Nov 2003
    Posts
    3,152
    My Symantec CE uses the admin password and account to get out to the internet to get its updates ???

    check your accounting database setup...is it using SQL Desktop engine??? admin password??

    Are you using sharepoint???

    check your scheduled tasks?

    Did you reboot after you changed the password???

    That should show you what service tried to start uo...set to automatic....and couldnt.

    Lots of services are dependant on other ones.

    MLF
    How people treat you is their karma- how you react is yours-Wayne Dyer

  9. #9
    Junior Member
    Join Date
    Jul 2006
    Posts
    14
    I checked my accounting database, its running ODBC and I couldnt find any logon information, so I turned off the hosting service on the server and the errors continued.

    I do have sharepoint running but we are not actually using it at this time.

    All of the processes in my scheduled tasks appear to be running just fine, I reset all of the passwords anyways just to make sure.

    Since I changed the password I have restarted my machine a number of times, I havent restarted it today.
    There are 10 types of people in this world, those who understand binary, and those who donít.

  10. #10
    AOs Resident Troll
    Join Date
    Nov 2003
    Posts
    3,152
    AFAIK...an ODBC connection uses a username and password to connect?????

    MLF

    edit

    Specifically, the SQLAgent$SBSMonitoring service is used to run a stored SQL job (in this case SBS_Database_Cleanup) that will remove entries from the
    SBSMonitoring database that are over 90days old.

    The owner of that job should be the domainname\Administrator account.

    http://groups.google.ca/group/micros...baede755a92c18
    How people treat you is their karma- how you react is yours-Wayne Dyer

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •