MonitorWare Knowledge Base

Hi,
Can anyone help as to why this error is reported on out
Mail Server. Our Domain is Workways.com.au. Is this
evidence of an attempt to log on to our network or
something else generated by another mail server??

Event Type: Failure Audit
Event Source: Security
Event Category: Logon/Logoff
Event ID: 529
Date: 28/04/2003
Time: 15:02:29
User: NT AUTHORITY\SYSTEM
Computer: CENTRALS5
Description:
Logon Failure:
Reason: Unknown user name or bad password
User Name: DONALD$
Domain: TALLANGATTA_SC
Logon Type: 3
Logon Process: NtLmSsp
Authentication Package: NTLM
Workstation Name: DONALD

Thanks a lot.

damien

Damien,

if I get it right, this may be caused by a broken workstation domain
membership. I would try to delete the workstation "DONALD" from the domain
and then add it to the domain again. Of course, if DONALD is not a valid
member of your domain, you have an issue

In general, the following thread may also be helpful to you (see Eric
Fitzgerald's respone - second posting in the thread):

http://forum.adiscon.com/viewtopic.php?t=78&highlight=event+529

HTH
Rainer

I have a similar issue here is the logfile-

EVENT ID 529
USERNAME NT AUTHORITY\SYSTEM
COMPUTERNAME ABR-EXC01
TIME 9/15/2005 9:56:48 AM
MESSAGE Logon Failure:
Reason: Unknown user name or bad password
User Name: ADR$
Domain: ACCUDIRECTNW
Logon Type: 3
Logon Process: NtLmSsp
Authentication Package: NTLM
Workstation Name: ADR

I have googled the domain name which has come back with an American Mail List Company.

As you can all imagine this username & domain do not exist on our domain(s).

Would this just be down to spam hitting the exchange server and being reported back or would this be more sinister?

DJ