Announcement

Collapse
No announcement yet.

Security Event 529

Collapse
X
  • Filter
  • Time
  • Show
Clear All
new posts

  • Security Event 529

    Hello members, I have recently inherited a Small Business Server 2003 which was a bit of a mess. I have sorted most of the problems but am struggling with this security event.
    Event Type: Failure Audit
    Event Source: Security
    Event Category: Logon/Logoff
    Event ID: 529
    Date: 2008/11/04
    Time: 11:18:10 AM
    User: NT AUTHORITY\SYSTEM
    Computer: CONNECTDC1
    Description:
    Logon Failure:
    Reason: Unknown user name or bad password
    User Name: administrator
    Domain: connectivity
    Logon Type: 2
    Logon Process: Advapi
    Authentication Package: Negotiate
    Workstation Name: CONNECTDC1
    Caller User Name: NETWORK SERVICE
    Caller Domain: NT AUTHORITY
    Caller Logon ID: (0x0,0x3E4)
    Caller Process ID: 3284
    Transited Services: -
    Source Network Address: -
    Source Port: -

    CONNECTDC1 is the SBS on the network. The event occurs quite frequently. All the other pcís on the network are coming up with a successful audit. Everything on the network seems to be running fine this event is just grinding my gears. A process of solving this error would be greatly appreciated.

  • #2
    Re: Security Event 529

    What is "Caller Process ID: 3284" on the server?
    cheers
    Andy

    Please read this before you post:


    Quis custodiet ipsos custodes?

    Comment


    • #3
      Re: Security Event 529

      Thanks for the quick response. Not to sure how to resolve the ID though.
      Please help!

      Comment


      • #4
        Re: Security Event 529

        Use task manager to see if it is still there, you can see the PID.
        cheers
        Andy

        Please read this before you post:


        Quis custodiet ipsos custodes?

        Comment


        • #5
          Re: Security Event 529

          Its my reportingservicesservice.exe

          Comment


          • #6
            Re: Security Event 529

            I've stopped the service and the error has gone. Is the error occuring because the password for the networkservice username for that service is incorrect.

            Comment


            • #7
              Re: Security Event 529

              Very likely!
              It looks like it is running under administrator so it is probably worth creating a new user account for it to run under. In the interim you can change the service username / password within services (I realise you know that!)
              cheers
              Andy

              Please read this before you post:


              Quis custodiet ipsos custodes?

              Comment


              • #8
                Re: Security Event 529

                A type 2 logon is a Console Logon from Local machine and the reportingservicesservice.exe is associated with a SQL server service.
                With that in mind and depending on the SQL version you use, check the account the service is running under!
                By default the Reporting services runs under a Domain user account (Whoever installed it).

                Check this for more info :http://msdn.microsoft.com/en-us/libr...4(SQL.90).aspx

                Ta
                Caesar's cipher - 3

                ZKHQ BRX HYHQWXDOOB GHFLSKHU WKLV BRX ZLOO UHDOLVH LW ZDV D ZDVWH RI WLPH!

                SFX JNRS FC U6 MNGR

                Comment


                • #9
                  Re: Security Event 529

                  Thanks for the help guys. My main problem was that I didn't know how to resolve the "caller process id". The server didn't need SQL so I just removed it. Problem gone.

                  Thanks Again!

                  Comment


                  • #10
                    Re: Security Event 529

                    Originally posted by SK8Dogga View Post
                    The server didn't need SQL so I just removed it. Problem gone.
                    Errr, can you expand on that statement? The server makes quite extensive use of SQL for Monitoring, WSUS, Sharepoint/Companyweb etc. If you are just referring to the Reporting Services, then you are correct that the server can manage fine without it!
                    TIA

                    Steven Teiger [SBS-MVP(2003-2009)]
                    http://www.wintra.co.il/
                    sigpic
                    Iím honoured to have been selected for the SMB 150 list for 2013. This is the third time in succession (no logo available for 2011) that I have been honoured with this award.

                    We donít stop playing because we grow old, we grow old because we stop playing.

                    Comment

                    Working...
                    X