Announcement

Collapse
No announcement yet.

Arcserve Backup v15 Causing Event ID 529

Collapse
X
  • Filter
  • Time
  • Show
Clear All
new posts

  • Arcserve Backup v15 Causing Event ID 529

    Hi All,

    Hoping someone might of stumbled across this before. We recently just built a new fileserver for one of our regional sites, and we use Arcserve backup as the preferred backup software of choice *Shudder*.

    Im having a weird problem, where it appears when we installed Arcserve somehow it has grabbed the username of my Admin account and constantly fills up the eventlogs with ID529 Failure audit. However the second part that is even more interesting is the failures are logged against server\admin_user not domain\admin_user.

    Now obviously there is no local admin account as described above. Additionally I have rerun the CA Arcserve backup config tool and made sure that my username is not mentioned anywhere (we use service accounts for backups), also the Arcserve services are all running under the service account as well.

    The logging seems to happen approx every hour, on the hour as well.

    Here is an extract of one of the failed audits. The names have been changed to protect the guilty

    Event Type: Failure Audit
    Event Source: Security
    Event Category: Logon/Logoff
    Event ID: 529
    Date: 28/11/2010
    Time: 11:00:43 PM
    User: NT AUTHORITY\SYSTEM
    Computer: FS-001
    Description:
    Logon Failure:
    Reason: Unknown user name or bad password
    User Name: admin_user
    Domain: FS-001
    Logon Type: 2
    Logon Process: Advapi
    Authentication Package: Negotiate
    Workstation Name: FS-001
    Caller User Name: svc_backup
    Caller Domain: ABC
    Caller Logon ID: (0x0,0x16962)
    Caller Process ID: 1736
    Transited Services: -
    Source Network Address: -
    Source Port: -

    Event Type: Failure Audit
    Event Source: Security
    Event Category: Account Logon
    Event ID: 680
    Date: 29/11/2010
    Time: 12:00:42 AM
    User: NT AUTHORITY\SYSTEM
    Computer: FS-001
    Description:
    Logon attempt by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
    Logon account: admin_user
    Source Workstation: FS-001
    Error Code: 0xC0000064


    So anyone that has any ideas, im all ears!!! Thx in advance

  • #2
    Re: Arcserve Backup v15 Causing Event ID 529

    Check to see if the admin user was entered for the ARCserve System Account.

    Select Server Admin and then Server Admin from the Menu bar and then ARCserve System Account.

    Comment

    Working...
    X