Event ID 535 with computer name as user name

[George]

Hello,
I am getting this event every few minutes in the security
log for our Exchange2000 server. What's strange is that
it uses the Server Name with a $ symbol for the User
Name. I cant determine if this is the computer account
that AD uses in Users and Computers or if it is something
else. Any help would be appreciated.

Logon Failure:
Reason: The specified account's password
has expired
User Name: "ComputerName$"
Domain: "Domain"
Logon Type: 3
Logon Process: NtLmSsp
Authentication Package: NTLM
Workstation Name: Workstation

Regards,
George

 

[Steven L Umbach]

Computers have passwords also, so it may mean there is a problem with the computer
account. Running netdiag on that machine may help determine what the problem is by
showing any failed tests. The $ designates a computer account. You may be able to use
netdom to fix the problem as described in KB link below. Also ask user of that
computer if they are having any access problems.--- Steve

http://support.microsoft.com/default.aspx?scid=kb;en-us;216393
http://support.microsoft.com/default.aspx?scid=kb;en-us;321708