• RSS
  • Twitter
  • FaceBook

Security Forums

Log in

FAQ | Search | Usergroups | Profile | Register | RSS | Posting Guidelines | Recent Posts

How do you track down Server 2003 failure audits???

Users browsing this topic:0 Security Fans, 0 Stealth Security Fans
Registered Security Fans: None
Post new topic   Reply to topic   Printer-friendly version    Networking/Security Forums Index -> Computer Forensics and Incident Response

View previous topic :: View next topic  
Author Message
decoy5657
Just Arrived
Just Arrived


Joined: 27 Jan 2009
Posts: 0


Offline

PostPosted: Tue Jan 27, 2009 6:29 pm    Post subject: How do you track down Server 2003 failure audits??? Reply with quote

We are getting a lot of these type errors for different usernames that actually exist on our domain. Not the usual admin/guest/user/administrator brute force stuff.

How can I decipher what's going on here? without any source/target info it is difficult to understand.

Code:
Source    Event ID    Last Occurrence    Total Occurrences   
  Security    529    1/26/2009 5:20 PM    7 *   
Logon Failure:   
    Reason:   Unknown user name or bad password   
    User Name:   realusername   
    Domain:       
    Logon Type:   3   
    Logon Process:   Advapi   
    Authentication Package:   MICROSOFT_AUTHENTICATION_PACKAGE_V1_0   
    Workstation Name:   PRIMARY   
    Caller User Name:   PRIMARY$   
    Caller Domain:   realdomain   
    Caller Logon ID:   (0x0,0x3E7)   
    Caller Process ID:   5236   
    Transited Services:   -   
    Source Network Address:   -   
    Source Port:   -   
Back to top
View user's profile Send private message
Display posts from previous:   

Post new topic   Reply to topic   Printer-friendly version    Networking/Security Forums Index -> Computer Forensics and Incident Response All times are GMT + 2 Hours
Page 1 of 1


 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum

Community Area

Log in | Register