Strange failure audit in 2003 R2 X64 SP2

Question

our server is running 2003 R2 X64 SP2, we keep seeing this in clusters of around 4 rapid fire. Sometimes 2 hours, sometimes around 8 hours apart with slight variations. I am also seeing the same blank username and domain in an account locked out message, I have tried disabling all scheduled tasks, if anyone has any idea please let me know! I find these processes running out of svc host:

AeLookupSvc, AppMgmt, BITS, Browser, CryptSvc, dmserver, EventSystem, helpsvc, IAS, lanmanserver, lanmanworkstation, Netman, Nla, RasMan, Schedule, seclogon, SENS, SharedAccess, ShellHWDetection, winmgmt, wuauserv, WZCSVC

Logon Failure: Reason: Account currently disabled
User Name:


Domain:

Logon Type: 3
Logon Process: Authz

Authentication Package: Kerberos
Workstation Name: PPCLUBES_TS
Caller User Name: PPCLUBES_TS$
Caller Domain: PPCLUBES
Caller Logon ID: (0x0,0x3E7)
Caller Process ID: 928
Transited Services: -
Source Network Address: -
Source Port: -

Answer 1

From what I can gather and assuming that PPCLUBES_TS is the name of the server that the message is being logged on if a service is attempting to log on with the built-in SYSTEM account.

Try the following:

1. Stop the WMI Service

   net stop winmgmt

2. Wait to see if the Event recurs

If this seems to solve the problem you can re-compile the SCM.mof

1. From a cmd prompt enter the following (replace 00:00 with a time a few minutes from now):

   at 00:00 /interactive cmd.exe

2. When a new cmd prompt starts switch to it

3. Change directory to C:\Windows\System32\wbem

4. Execute the following command

   mofcomp scm.mof

5. Start/Restart the WMI service

   net start winmgmt