-
January 12th, 2009, 07:22 PM
#1
Failure Audit log entries
Hey all,
We had some strange things going on with our website yesterday, and in reviewing the logs, I noticed a whole bunch of Failure Audits (more than 12,000 of them within 20 minutes). I'm a little confused by what exactly is going on - I have a 680 Event ID immediately followed by a 529 Event ID (6,000+ of each). Below are the entries - the only difference between the successive entries is the time. This is Server 2003 Standard Edition - there's no Administrator account. Not sure what the 20372 PID is/was, as it's not running right now...
680:
Event Type: Failure Audit
Event Source: Security
Event Category: Account Logon
Event ID: 680
Date: 1/11/2009
Time: 8:23:41 AM
User: NT AUTHORITY\SYSTEM
Computer: STATECE-WEB1
Description:
Logon attempt by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon account: Administrator
Source Workstation: STATECE-WEB1
Error Code: 0xC0000064
529:
Event Type: Failure Audit
Event Source: Security
Event Category: Logon/Logoff
Event ID: 529
Date: 1/11/2009
Time: 8:23:41 AM
User: NT AUTHORITY\SYSTEM
Computer: STATECE-WEB1
Description:
Logon Failure:
Reason: Unknown user name or bad password
User Name: Administrator
Domain: STATECE-WEB1
Logon Type: 8
Logon Process: IIS
Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Workstation Name: STATECE-WEB1
Caller User Name: STATECE-WEB1$
Caller Domain: NEOSPIRE
Caller Logon ID: (0x0,0x3E7)
Caller Process ID: 20372
Transited Services: -
Source Network Address: -
Source Port: -
Similar Threads
-
By cheyenne1212 in forum Miscellaneous Security Discussions
Replies: 7
Last Post: February 1st, 2012, 02:51 PM
-
By sumitprateek in forum General Computer Discussions
Replies: 17
Last Post: June 23rd, 2008, 07:42 PM
-
By rpgraff in forum Spyware / Adware
Replies: 16
Last Post: August 24th, 2004, 08:01 AM
-
By netknow in forum Microsoft Security Discussions
Replies: 2
Last Post: September 5th, 2003, 04:45 PM
-
By Info Tech Geek in forum Network Security Discussions
Replies: 9
Last Post: July 30th, 2003, 07:44 PM
Posting Permissions
- You may not post new threads
- You may not post replies
- You may not post attachments
- You may not edit your posts
-
Forum Rules
|
|