One of our domain member servers keeps producing continuous login failures (caught in Event viewer via Audit Policy) almost every minute. Here's a typical failure log (names & IPs obfuscated):
Event Type: Failure Audit Event Source: Security Event Category: Logon/Logoff Event ID: 529 Date: 11/10/2014 Time: 8:44:49 PM User: NT AUTHORITY\SYSTEM Computer: MY_SERVER Description: Logon Failure: Reason: Unknown user name or bad password User Name: Administrator Domain: MY_DOMAIN Logon Type: 10 Logon Process: User32 Authentication Package: Negotiate Workstation Name: MY_SERVER Caller User Name: MY_SERVER$ Caller Domain: MY_DOMAIN Caller Logon ID: (0x0,0x3E7) Caller Process ID: 2548 Transited Services: - Source Network Address: 22.214.171.124 Source Port: 42985 For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
What's frustrating is I'm unable to track which service / process is causing this. What is the best way to track this?