My Server is trying to log into itself

[Rojany]

Ok, I've searched through more websites then I care to admit regarding this issue and have tried everything short of a reinstall. I'm running a m$ Small Business Server 2k3 w/ sp1 and I am getting 4 failure audits every other minute (like clockwork), It appears that my server machine is trying to log into the domain and failing, everything is working fine but I have no idea how to fix this. Just incase it helps here is the event listing:

Event Type: Failure Audit
Event Source: Security
Event Category: Logon/Logoff
Event ID: 529
Date: 7/12/2006
Time: 7:12:38 AM
User: NT AUTHORITY\SYSTEM
Computer: SERVER-SBS
Description:
Logon Failure:
Reason: Unknown user name or bad password
User Name: SERVER-SBS$
Domain: LOCALDOMAIN
Logon Type: 3
Logon Process: NtLmSsp
Authentication Package: NTLM
Workstation Name: SERVER-SBS

As for its regularity, its 4 failure audits (all within 1-2 seconds) every other minute, regardless of any client systems being on or off.

I'm getting tired of banging my head on the wall over this issue so I am hoping that someone here could possibly give me some insight on at least where to go to resolve this error.

[morganlefay]

Well...MS offers support for 245.00 USD....per incident

Alot less of a cost then a reinstall of a server.....

Now...what 3rd party applications do you run on this server?? AV etc

Is this standard or premium sbs???

Do you have a firewall??

Do you have any remote services activated???

When did this start to happen???

How old is the install???

MLF

edit>

Did you change the admin account\password???

here is a great resource....http://www.microsoft.com/technet/com...ows.server.sbs

and a search on this group turned up this

http://www.microsoft.com/technet/com...xp=&sloc=en-us

[Rojany]

Well as for the 3rd party software I have MacAfee’s Total Protection for Small Business (trial account), and I have our accounting software host running as a service (MAS 90/200). It’s just the standard edition of sbs and I only installed it about a month and a half ago, I noticed these issues about a month ago. The only firewall that I am running is from my rougher.

[morganlefay]

Not sure if you saw my edit

Did you change the admin password or account???

Do you have any services\ports open on the router?? OWA, VPN,Remote Workplace????

MLF

[Rojany]

Sorry no I didn’t see the edit but I have changed the admin password but the account name is still Administrator. As for the router I do have some ports open so we can have our OS/400 guy can get in to access what he needs on that system, to save some time on that issue I have tried to narrow the search by unplugging the network (off hours) and the failure audits were still happening.

[morganlefay]

OK...when you changed the admin password...did you reset it for all services...because that is what is happening...

Any errors in the system or application event logs.....that should point to what is failing

What you need to do is reset the password on all services\applications that use the administrator password to run.

Its probably your MacAffee ...gut feeling

MLF

[Rojany]

Alright I checked my services and I didnt see anything except, local service, local system, network service, and nt authority\network service. After checking my system & application event logs I did find that I was having errors with SQLAgent$SBSMONITORING, I stopped that service (wich should stop any of it's login attempts right?) and am still getting the same failure audits. I checked my McAfee and its logged in under local system.

[morganlefay]

My Symantec CE uses the admin password and account to get out to the internet to get its updates ???

check your accounting database setup...is it using SQL Desktop engine??? admin password??

Are you using sharepoint???

check your scheduled tasks?

Did you reboot after you changed the password???

That should show you what service tried to start uo...set to automatic....and couldnt.

Lots of services are dependant on other ones.

MLF

[Rojany]

I checked my accounting database, its running ODBC and I couldnt find any logon information, so I turned off the hosting service on the server and the errors continued.

I do have sharepoint running but we are not actually using it at this time.

All of the processes in my scheduled tasks appear to be running just fine, I reset all of the passwords anyways just to make sure.

Since I changed the password I have restarted my machine a number of times, I havent restarted it today.

[morganlefay]

AFAIK...an ODBC connection uses a username and password to connect?????

MLF

edit

Specifically, the SQLAgent$SBSMonitoring service is used to run a stored SQL job (in this case SBS_Database_Cleanup) that will remove entries from the
SBSMonitoring database that are over 90days old.

The owner of that job should be the domainname\Administrator account.

http://groups.google.ca/group/micros...baede755a92c18