Event ID's 529

[Andy M]

Hello

I wonder if anyone can help?

We have a client which runs SBS2k3 and almost on every day blocks of either
50 to 100 of the above events (see full details below), in a very short space
of time (like minutes together) are recorded in the event logs. Sometimes the
Logon Type is different (eg 3), somtimes the User Name is different such as
"Webmaster" and the Caller Process ID is different too, I have had no luck
searching for soultions or even trying to track down the problem , also the
client recently moved so all the broadband packege and details are different,
I was hoping with the client move the problem would go away, but it didn't.
Is anyone able to shed any light on this and how to stop it from occurring.

Here is full event detail:-

Event Type: Failure Audit
Event Source: Security
Event Category: Logon/Logoff
Event ID: 529
Date: 06/01/2009
Time: 10:35:58
User: NT AUTHORITY\SYSTEM
Computer: <SERVER NAME>
Description:
Logon Failure:
Reason: Unknown user name or bad password
User Name: admin
Domain: <SERVER DOMAIN>
Logon Type: 8
Logon Process: IIS
Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Workstation Name: <SERVER NAME>
Caller User Name: <SERVER NAME>$
Caller Domain: <SERVER DOMAIN>
Caller Logon ID: (0x0,0x3E7)
Caller Process ID: 2672
Transited Services: -
Source Network Address: -
Source Port: -


For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

BTW the MS Help and Support Center, unfortunately is very helpful or
supportive with this issue.

Many thanks


Andy
MBS

[SteveB]

You'll get more response by posting in the newsgroup for SBS 2003.

microsoft.public.windows.server.sbs

As long as you have strong passwords you can probably ignore most of these
529 events. All SBS boxes seem to be hit frequently by them. Sometimes the
user names are common and sometimes you'll see something strange like
"inna."

Post by Andy M
Hello
I wonder if anyone can help?
We have a client which runs SBS2k3 and almost on every day blocks of either
50 to 100 of the above events (see full details below), in a very short space
of time (like minutes together) are recorded in the event logs. Sometimes the
Logon Type is different (eg 3), somtimes the User Name is different such as
"Webmaster" and the Caller Process ID is different too, I have had no luck
searching for soultions or even trying to track down the problem , also the
client recently moved so all the broadband packege and details are different,
I was hoping with the client move the problem would go away, but it didn't.
Is anyone able to shed any light on this and how to stop it from occurring.
Here is full event detail:-
Event Type: Failure Audit
Event Source: Security
Event Category: Logon/Logoff
Event ID: 529
Date: 06/01/2009
Time: 10:35:58
User: NT AUTHORITY\SYSTEM
Computer: <SERVER NAME>
Reason: Unknown user name or bad password
User Name: admin
Domain: <SERVER DOMAIN>
Logon Type: 8
Logon Process: IIS
Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Workstation Name: <SERVER NAME>
Caller User Name: <SERVER NAME>$
Caller Domain: <SERVER DOMAIN>
Caller Logon ID: (0x0,0x3E7)
Caller Process ID: 2672
Transited Services: -
Source Network Address: -
Source Port: -
For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
BTW the MS Help and Support Center, unfortunately is very helpful or
supportive with this issue.
Many thanks
Andy
MBS