My Server is trying to log into itself

Ok, I've searched through more websites then I care to admit regarding this issue and have tried everything short of a reinstall. I'm running a m$ Small Business Server 2k3 w/ sp1 and I am getting 4 failure audits every other minute (like clockwork), It appears that my server machine is trying to log into the domain and failing, everything is working fine but I have no idea how to fix this. Just incase it helps here is the event listing:

Event Type: Failure Audit
Event Source: Security
Event Category: Logon/Logoff
Event ID: 529
Date: 7/12/2006
Time: 7:12:38 AM
User: NT AUTHORITY\SYSTEM
Computer: SERVER-SBS
Description:
Logon Failure:
Reason: Unknown user name or bad password
User Name: SERVER-SBS$
Domain: LOCALDOMAIN
Logon Type: 3
Logon Process: NtLmSsp
Authentication Package: NTLM
Workstation Name: SERVER-SBS

As for its regularity, its 4 failure audits (all within 1-2 seconds) every other minute, regardless of any client systems being on or off.

I'm getting tired of banging my head on the wall over this issue so I am hoping that someone here could possibly give me some insight on at least where to go to resolve this error.

Well...MS offers support for 245.00 USD....per incident

Alot less of a cost then a reinstall of a server.....

Now...what 3rd party applications do you run on this server?? AV etc

Is this standard or premium sbs???

Do you have a firewall??

Do you have any remote services activated???

When did this start to happen???

How old is the install???

MLF

edit>

Did you change the admin account\password???

here is a great resource....http://www.microsoft.com/technet/com...ows.server.sbs

and a search on this group turned up this

http://www.microsoft.com/technet/com...xp=&sloc=en-us

Well as for the 3rd party software I have MacAfee’s Total Protection for Small Business (trial account), and I have our accounting software host running as a service (MAS 90/200). It’s just the standard edition of sbs and I only installed it about a month and a half ago, I noticed these issues about a month ago. The only firewall that I am running is from my rougher.

Not sure if you saw my edit

Did you change the admin password or account???

Do you have any services\ports open on the router?? OWA, VPN,Remote Workplace????

MLF

Sorry no I didn’t see the edit but I have changed the admin password but the account name is still Administrator. As for the router I do have some ports open so we can have our OS/400 guy can get in to access what he needs on that system, to save some time on that issue I have tried to narrow the search by unplugging the network (off hours) and the failure audits were still happening.

OK...when you changed the admin password...did you reset it for all services...because that is what is happening...

Any errors in the system or application event logs.....that should point to what is failing

What you need to do is reset the password on all services\applications that use the administrator password to run.

Its probably your MacAffee ...gut feeling

MLF

Alright I checked my services and I didnt see anything except, local service, local system, network service, and nt authority\network service. After checking my system & application event logs I did find that I was having errors with SQLAgent$SBSMONITORING, I stopped that service (wich should stop any of it's login attempts right?) and am still getting the same failure audits. I checked my McAfee and its logged in under local system.

My Symantec CE uses the admin password and account to get out to the internet to get its updates ???

check your accounting database setup...is it using SQL Desktop engine??? admin password??

Are you using sharepoint???

check your scheduled tasks?

Did you reboot after you changed the password???

That should show you what service tried to start uo...set to automatic....and couldnt.

Lots of services are dependant on other ones.

MLF

I checked my accounting database, its running ODBC and I couldnt find any logon information, so I turned off the hosting service on the server and the errors continued.

I do have sharepoint running but we are not actually using it at this time.

All of the processes in my scheduled tasks appear to be running just fine, I reset all of the passwords anyways just to make sure.

Since I changed the password I have restarted my machine a number of times, I havent restarted it today.

AFAIK...an ODBC connection uses a username and password to connect?????

MLF

edit

Quote:

---

Specifically, the SQLAgent$SBSMonitoring service is used to run a stored SQL job (in this case SBS_Database_Cleanup) that will remove entries from the
SBSMonitoring database that are over 90days old.

The owner of that job should be the domainname\Administrator account.

---

http://groups.google.ca/group/micros...baede755a92c18

Ok, after looking deeper into the ODBC settings, it looks like its going through the hosting service using its credentials.

I changed the owner of my SQLAgent$SBSMonitoring service to the Administrator account.

Still getting the failure audits.

I PMed you a link on reinstalling the monitoring service....

MLF

I have a few questions.

1.) Is the SBS the only DC on the LAN?

2.) Are you auditing failure events only or sucess and failure events. If you're not auditing sucessful login attempts, turn that on. Then wait a few minutes, then take a look in the event log and see if you are also logging any Event ID 552 events.

If you get the 552 errors, post the PID of the process.

3.) Is it SBS Standard or Premium?

4.) Does the McAfee Product include McAfee ePO, and if so, what version? I had a similar issue running McAfee ePO on a SBS box once.

The only thing that vexes me is that it's saying Logon Type 3, and that's usually what you get from a failed logon using network credentials, i.e. a user logging on from across the network. :confused:

EDIT: Man I'm an idiot...I re-read the thread and see that you already answered Question 3...Duh.

I figured out what was causing my problems, it wasn’t the monitoring service (but I still think there is a problem with it so I am going to reinstall it). It was the Exchange Server, it isn’t fixed yet but the 4 failure audits I am getting are from, m$ Exchange Manager, m$ Exchange MTA Stacks, m$ Exchange Routing Engine, and m$ Exchange System Attendant.

Not sure what I am going to do with that knowledge yet, but that can wait until tomorrow (not utilizing this feature yet).

Quote:

---

Lots of services are dependant on other ones.

MLF

---

Thank you; this is what made me follow the dependencies to find exchange.

As for your questions 576869746568617, yes it’s the only DC, I was logging all events in the log, not just failure, and I don’t see anything about ePO in my McAfee, maybe it’s just because it’s a trial version.

Thanks a bunch for all the help

You know what you can try is to change the password back to what it was.....and see if that clears the errors??...then you know it is password related..remember to restart

Use the exact method you used to change it in the first place...you may be able to reverse the affects

also how did you change it in the first place...there is a wizard you are supposed to use in the server management console...which will change it for all sbs services....you then have to manually reset 3rd party apps that use the admin account

Exchange is a very fussy beast...... ;)

All my support calls to ms have been due to exchange issues...... :(

Any changes to the exchange setup recently..???

Can you manually start the services???

Disable your AV...see if your errors clear up......I have never had success with MacAfee on SBS...and AV needs to be tweaked on a SBS...because of all the apps and services it runs.

Trend has a SBS version....so does symantec

Post your errors...may be able to help.

Also that newsgroup I posted previously is a great help....

Good luck

MLF

Just skimmed all the responces but it looks like the computer account was removed. Every computer that's part of the domain has a computer account. These are in the form COMPUTERNAME$. What you should do on the server that's causing problems.. Remove it from the domain, put it in a workgroup. Reboot. Then add it to the domain again and reboot. That should solve it.

Sorry mr dice...but if you did that with a SBS....I think you would make it unrepairable...

The SBS has many services...and it wouldnt like that very much

there is no way to change a sbs name or domain.....

Do not do this unless you are willing to do a full reinstall


MLF

When ever I work with password related issues I just go into server management and make any changes in the users listing there.

As for the antivirus, the trial version expires tomorrow so I have uninstalled it. I have been looking into the trend antivirus for SBS and it's comforting to hear it being suggested, thank you.

Exchange has been a thorn in my side since we loaded SBS; I have been getting errors from the system attendant, information store, as well as a few others that I can’t recall at the moment. Because of this I haven't actually incorporated it through my company yet, the only people that use it is the other admin and myself so I am curious about your thoughts on just remove and reload it like you were suggesting with the monitoring (if that’s even possible).

I have tried to change the domain shortly after install and it did cause a lot of errors (never did work right again) and I had to resort to a reinstall so I am very hesitant to make any changes of that nature.

And I am willing to do a full reinstall if thats whats needed, but that is more of a last resort in my mind.

Well thats the problem...you broke exchange when you changed the domain name....you cannot rename a DC domain\machine with exchange on it

AFAIK...there is no fixing....


Now if you don not have any data in exchange...I would backup what data you have..and start from scratch.

I would make this site your home page...and read all the technical and setup documentation provided....twice ;)

http://www.microsoft.com/windowsserv...s/default.mspx


my last install of SBS 2003...took me 3 tries to ensure I had no errors or issues on the base install and setup

This from experience as I have been working with SBS since the first version 4.0. (1998)

There is no changing of core settings once installed...sure you can..but you will never recover in my experience...and problems will just compound themselves to the point of instability.

The SBS is a solid machine if correctly setup and maintained...with strong hardware to support it.

My job has been to fix SBS servers that have been installed by people that did not install it right in the first place.

or have fiddled with the install....and initial setup.

Trust me...I know this beast :cool:

Keeps me in fine wine :D

MLF

Sorry I guess I didnt make this very clear, I did change the domain, got all kind of errors that I couldnt get myself out of, reformated the drive and finnaly reinstalled sbs from scratch. Since that point (beguining of my second install), we had some problems with exchange that we though we had fixed but apperently havent.

OK....

Then post your exchange errors....

I maybe able to help.

It is worth the 245.00 call to MS.....they will work with you til the issue is resolved....and if it is a coding error or bug...the call is free...

MLF

Ok, currently the only errors I am getting is the eccessive invalid logins wich stop when I stop the exchange services mentioned earlier.

When we were working on getting exchange working, we had the following errors in the Performance Report:

Source Event ID Last Occurrence Total Occurrences
MSExchangeSRS 1002 6/24/2006 11:25 AM 1
The Microsoft Exchange Site Replication Service database (EDB) could not be initialized and returned error 1. Unrecoverable error, the Site Replication service can't continue. For more information, click http://www.microsoft.com/contentredirect.asp.

Source Event ID Last Occurrence Total Occurrences
MSExchangeAL 8026 6/24/2006 10:49 AM 6 *
LDAP Bind was unsuccessful on directory PacificFish-SBS.PacificFish.local for distinguished name ''. Directory returned error:[0x51] Server Down. For more information, click http://www.microsoft.com/contentredirect.asp.


Source Event ID Last Occurrence Total Occurrences
MSExchangeAL 8250 6/24/2006 10:49 AM 2 *
The Win32 API call 'DsGetDCNameW' returned error code [0x862] The specified component could not be found in the configuration information. The service could not be initialized. Make sure that the operating system was installed properly. For more information, click http://www.microsoft.com/contentredirect.asp.

Source Event ID Last Occurrence Total Occurrences
MSExchangeDSAccess 2102 6/24/2006 10:49 AM 2 *
Process MAD.EXE (PID=2400). All Domain Controller Servers in use are not responding: PacificFish-SBS.PacificFish.local For more information, click http://www.microsoft.com/contentredirect.asp.

Source Event ID Last Occurrence Total Occurrences
MSExchangeDSAccess 2104 6/24/2006 10:49 AM 2 *
Process INETINFO.EXE (PID=1992). All the DS Servers in domain are not responding. For more information, click http://www.microsoft.com/contentredirect.asp.

I dont understand how this resolved the errors but our other admin said he created a public mailbox, accessed it, then removed it.

So the exchange server is working now???

These errors happen when you startup and shutdown the server...then stop??

MLF

We arnt getting any errors right now from the exchange server (yes its working), we are getting the logon errors in the security event log (error 529) as stated earlier.

When I turn off the exchange services mentioned earlier (m$ Exchange Manager, MTA Stacks, Routing Engine, and System Attendant), the security log errors stop.

So this is what is telling me that it is exchange that is causing the problems.

Quote:

---

Originally posted here by morganlefay
Sorry mr dice...but if you did that with a SBS....I think you would make it unrepairable...

The SBS has many services...and it wouldnt like that very much

there is no way to change a sbs name or domain.....

Do not do this unless you are willing to do a full reinstall

---

Ah.. Didn't know that.. Never used SBS..

The login error (first post) does point to a non-existant or expired computer domain account though.. Perhaps just adding the computer account to the domain might resolve it?

Just a suggestion.

Turn off services 1 at a time & then check the logs.

When the errors in the logs stop, the last service you switched off was responsible.

You should then be able to research that service to try and fix the problem.

Steve

Excellent suggestion Steve

This should show you what service aredependant...

also those exchange errors are normal on an SBS during shutdown and startup...its the way and order services startup...and exchange is starting up faster then its dependant services....the errors will usually stop once all services have strated up....I misunderstood...I thought your exchange server wasnt working either

MLF

Those 4 services produce an invalid login attempt every 2 minutes, I have shut them down independently, and each one seems to be attached to a different logon attempt.

It’s not like I am getting the errors when I shutdown and start up, it’s a continuous logon cycle.

Quote:

---

You know what you can try is to change the password back to what it was.....and see if that clears the errors??...

---

This won't work. Whenever you change a PW on a win32 host, even if it's the same, the SID changes and thus, you're fooked. Exchange looks at SIDs.

Promoting exchange into the domain requires specific steps in specific order. The link provoded by morganfly will assist you.

If the event viewer logs are not helpful enough, perhaps looking at the processes with strace or other process exploration tools? Typically this is what I do when event viewer logs are less than helpful.

The two minute interval is key here. Using that info, you can narrow down what service does this attempt every 120 seconds.

--TH13

Quote:

---

Originally posted here by thehorse13
Whenever you change a PW on a win32 host, even if it's the same, the SID changes and thus, you're fooked. Exchange looks at SIDs.

---

SIDs do not change when you change the password. A SID is akin to an username.. SIDs do change with a reinstall or when deleting then recreating a useraccount (same username, different SID, hence 'different' account)....

Quote:

---

SIDs do not change when you change the password

---

I didnt think so...

I have never had an issue changing the admin password...with 2003...so no experience in fixing it. :(

Now..with the SBS 4 and 4.5..I had many an issue changing the admin password...and by changing it back to what it was...I was able to recover.

Just thought it may have worked in this case too.......

although sounds to me there has been some fiddling....hence the issues..2 admins for an SBS...??? limited up to 75 users??

You know what they say....too many cooks.......

If the exchange is running and users can connect...and you are having this log on error....something is calling an email\exchange process...with an account that doesnt have the rights to do so.

Maybe its your database program...that emails from itself...and is using the wrong credentials....

Or some custom public mailbox.....you were saying Rojany ????


I dont quite understand this :confused:

Quote:

---

I dont understand how this resolved the errors but our other admin said he created a public mailbox, accessed it, then removed it.

---

MLF

Yes we have 2 Admins; the other one would just prefer to leave this alone because "It’s working fine, so it can’t be that important."

He was playing in exchange trying to figure out some basic features (shared mailboxes/folders) created a folder that everyone could access (in exchange) then deleted it. Somehow this cleared the system attendant errors, and created the invalid login attempts.

This is my first time working with exchange so I apologize if I'm getting a little frustrating, I'm still learning it.

Quote:

---

SIDs do not change when you change the password. A SID is akin to an username.. SIDs do change with a reinstall or when deleting then recreating a useraccount (same username, different SID, hence 'different' account)....

---

Hmmmm, I stand corrected. I must have been thinking about the key for disk encryption that is linked to the PW on the account.

I'll be turning in my pots on this cook off. ;)

--TH13