Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I am receiving lots of Failure Audit logs on my DC, can you guide me - how should i identify the culprit.

Please see the below print-screen for more detail. The logon type is 3, that means it is a network logon. I have identify the Workstation from the log, but how should i prove who or which process is sending broadcast with logon authentication to my DC. The Anti-virus is also updated.

Note:- The Workstation is in Workgroup.enter image description here

share|improve this question

2 Answers 2

use tcp view http://technet.microsoft.com/en-us/sysinternals/bb897437.aspx on the workstation it will tell you the process that is talking to the dc.

share|improve this answer

As you said, your anti virus is updated, just perform virus scanning on all workstations or turn on IIS logging.

Refer the following link for error event: event id 4625

The thread can also be monitored by a third party tool.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.