failure audit

[Elsie]

hi all, found these event messages almost everyday. does this mean that the
logon account of edp is trying to access my pc?

Logon attempt by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon account: edp
Source Workstation: CHEN
Error Code: 0xC0000064

Logon Failure:
Reason: Unknown user name or bad password
User Name: edp
Domain: CHEN
Logon Type: 3
Logon Process: NtLmSsp
Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Workstation Name: CHEN

 

[Malke]

hi all, found these event messages almost everyday. does this mean
that the logon account of edp is trying to access my pc?

Logon attempt by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon account: edp
Source Workstation: CHEN
Error Code: 0xC0000064

Logon Failure:
Reason: Unknown user name or bad password
User Name: edp
Domain: CHEN
Logon Type: 3
Logon Process: NtLmSsp
Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Workstation Name: CHEN

Looks like it. What do your firewall logs say?

Malke

 

[Elsie]

where to check firewall logs? don't have firewall installed on pc, ICF not
on because we are in a LAN.

 

[Malke]

where to check firewall logs? don't have firewall installed on pc, ICF
not on because we are in a LAN.

If you are in a corporate environment, you should certainly have a
firewall in place, hardware and/or software. Ask your sysadmin. If you
*are* the sysadmin, you need to get some security in place. A firewall
log would be in whatever place your firewall software puts it, or you
decided it should be. If you don't have a sysadmin who is knowledgeable
about security, get an outside professional to come in and check over
your network. If you need more help, then please repost with a better
description of your network setup, what you are running, how many
machines, etc.

Malke

 

[Elsie]

I discovered those messages from event viewer on my pc running win xp pro.
edp is one of the domain admin accounts. so does this mean that this account
is trying to somehow remote login to my pc? anyway, I disabled the default
Guest account. if I am not wrong, under control panel--> users, all domain
admin accounts are under the Administrator group in my pc. and all domain
users are in Users group.

if edp is a domain admin and all domain admin are in Administrators group,
why did the attempted logon failed?

(hope I am making sense)

 

[Malke]

I discovered those messages from event viewer on my pc running win xp
pro. edp is one of the domain admin accounts. so does this mean that
this account is trying to somehow remote login to my pc? anyway, I
disabled the default Guest account. if I am not wrong, under control
panel--> users, all domain admin accounts are under the Administrator
group in my pc. and all domain users are in Users group.

if edp is a domain admin and all domain admin are in Administrators
group, why did the attempted logon failed?

(hope I am making sense)

The logon from edp failed because that account isn't authenticated
locally on your workstation. You didn't answer my question about
whether you are the sysadmin or give any information about your network
setup. If this is a workstation on a corporate domain, you should
contact your IT Dept.

Malke

 

[Elsie]

I am admin of a workgroup server, but not of the domain. so I can't answer
you on the question about network setup. all I know I that the domain is on
NT 4.0. anyway, if the logon by edp fails, its good enough for me.
Thanks very much!