Failure Audit

[Jay]

Hi,
I've got a zillion entries to my event viewer - security.

Logon Failure:
Reason: Unknown user name or bad password
User Name: Owner
Domain: SPACE
Logon Type: 3
Logon Process: NtLmSsp
Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Workstation Name: SPACE

About 3 a second.
Further down are different usernames/domains.
What do I need to turn off (service) or configure (XP Pro - Kerio Firewall)
so that these attempts are ignored/blocked/whatever?

Jay

 

[Phil]

Just reboot, they should stop. I see those on my network at the office. As
far as I can tell it related to time syncing. I have all the computers in
the office sync to the time on the server and sometimes it seems it gets
"stuck". Usually a reboot will allow the requests to go thru with the error.

 

[Jay]

Just reboot, they should stop.

Many thanks Phil

 

[Phil]

Many thanks Phil

You're welcome. Sorry I can't explain better why it happens, just had some
experience with the same thing.

 

[Jay]

You're welcome. Sorry I can't explain better why it happens, just had some
experience with the same thing.

No problem, now that I know it's time sync I can stop worrying that it's
some kind of DOS attack.

Jay

 

[Phil]

No problem, now that I know it's time sync I can stop worrying that
it's some kind of DOS attack.

Jay

Ya your ok, its definitely a windows thing. You can find some info about it
on google if you'd like. Have a good one.