2

One of our domain member servers keeps producing continuous login failures (caught in Event viewer via Audit Policy) almost every minute. Here's a typical failure log (names & IPs obfuscated):

Event Type: Failure Audit
Event Source:   Security
Event Category: Logon/Logoff 
Event ID:   529
Date:       11/10/2014
Time:       8:44:49 PM
User:       NT AUTHORITY\SYSTEM
Computer:   MY_SERVER
Description:
Logon Failure:
    Reason:     Unknown user name or bad password
    User Name:  Administrator
    Domain:     MY_DOMAIN
    Logon Type: 10
    Logon Process:  User32  
    Authentication Package: Negotiate
    Workstation Name:   MY_SERVER
    Caller User Name:   MY_SERVER$
    Caller Domain:  MY_DOMAIN
    Caller Logon ID:    (0x0,0x3E7)
    Caller Process ID:  2548
    Transited Services: -
    Source Network Address: 1.2.3.4
    Source Port:    42985


For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

What's frustrating is I'm unable to track which service / process is causing this. What is the best way to track this?

2

Logon Type 10 is "Remote Interactive," i.e., what happens when someone attempts to establish a Remote Desktop/Terminal Services session with mstsc.exe, or Remote Assistance.

Someone might be trying to log in to your server via Remote Desktop using the user name Administrator and trying to guess the password.

If you were to view the Security event logs on MY_SERVER, you'd be able to see what IP address your wise guy is coming from.

This could also be an innocent case of "someone legitimately logged in as Administrator 100 days ago, then they left their session disconnected for a long time, then the password for Administrator was changed, and now the idle session is still trying to reauthenticate as Administrator using the old password."

  • Ryan - thank you very much for your prompt reply. My guess was along the 2nd one as well. Quick question - where can I see the IP in my security log? It's not part of the failure event. – miCRoSCoPiCeaRthLinG Nov 10 '14 at 14:56
  • If it's not in the corresponding Failure Audit event on MY_SERVER, then you'll have to do some digging. Your question is tagged Server 2008, but the event ID 529 that you cite is a pre-Vista event ID. The events were updated/upgraded with Vista/2008+ (they contain more info,) and the event IDs were changed to 4 digits. All you have to do to validate this theory is connect to MY_SERVER with a Remote Desktop Manager MMC snap-in and see if Administrator has a logon session on MY_SERVER, and kick him off if he does. – Ryan Ries Nov 10 '14 at 15:23
  • You're right. I tagged wrong. While all our servers are 2008 & up, this particular one is running on 2003. Any idea where to look on that? – miCRoSCoPiCeaRthLinG Nov 10 '14 at 15:46
  • I'd use netstat to see where connections to port 3389 are coming from. But if the logon attempts are simply due to an idle session on that server, then there will be no remote IP address associated with it. – Ryan Ries Nov 10 '14 at 16:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.