One of our domain member servers keeps producing continuous login failures (caught in Event viewer via Audit Policy) almost every minute. Here's a typical failure log (names & IPs obfuscated):
Event Type: Failure Audit
Event Source: Security
Event Category: Logon/Logoff
Event ID: 529
Date: 11/10/2014
Time: 8:44:49 PM
User: NT AUTHORITY\SYSTEM
Computer: MY_SERVER
Description:
Logon Failure:
Reason: Unknown user name or bad password
User Name: Administrator
Domain: MY_DOMAIN
Logon Type: 10
Logon Process: User32
Authentication Package: Negotiate
Workstation Name: MY_SERVER
Caller User Name: MY_SERVER$
Caller Domain: MY_DOMAIN
Caller Logon ID: (0x0,0x3E7)
Caller Process ID: 2548
Transited Services: -
Source Network Address: 1.2.3.4
Source Port: 42985
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
What's frustrating is I'm unable to track which service / process is causing this. What is the best way to track this?