Hey all,

We had some strange things going on with our website yesterday, and in reviewing the logs, I noticed a whole bunch of Failure Audits (more than 12,000 of them within 20 minutes). I'm a little confused by what exactly is going on - I have a 680 Event ID immediately followed by a 529 Event ID (6,000+ of each). Below are the entries - the only difference between the successive entries is the time. This is Server 2003 Standard Edition - there's no Administrator account. Not sure what the 20372 PID is/was, as it's not running right now...

680:

Event Type: Failure Audit
Event Source: Security
Event Category: Account Logon
Event ID: 680
Date: 1/11/2009
Time: 8:23:41 AM
User: NT AUTHORITY\SYSTEM
Computer: STATECE-WEB1
Description:
Logon attempt by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon account: Administrator
Source Workstation: STATECE-WEB1
Error Code: 0xC0000064

529:

Event Type: Failure Audit
Event Source: Security
Event Category: Logon/Logoff
Event ID: 529
Date: 1/11/2009
Time: 8:23:41 AM
User: NT AUTHORITY\SYSTEM
Computer: STATECE-WEB1
Description:
Logon Failure:
Reason: Unknown user name or bad password
User Name: Administrator
Domain: STATECE-WEB1
Logon Type: 8
Logon Process: IIS
Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Workstation Name: STATECE-WEB1
Caller User Name: STATECE-WEB1$
Caller Domain: NEOSPIRE
Caller Logon ID: (0x0,0x3E7)
Caller Process ID: 20372
Transited Services: -
Source Network Address: -
Source Port: -