Security failures

[Chris S Patterson]

I have been geeting the fallowing errors often in my security log. The first
dealing with Kerberos and the second concern me the most. I am running
certificates


Event Type: Failure Audit
Event Source: Security
Event Category: Logon/Logoff
Event ID: 537
Date: 7/22/2004
Time: 6:05:08 PM
User: NT AUTHORITY\SYSTEM
Computer: CONAN
Description:
Logon Failure:
Reason: An unexpected error occurred during logon
User Name:
Domain:
Logon Type: 3
Logon Process: Kerberos
Authentication Package: Kerberos
Workstation Name: -


Event Type: Failure Audit
Event Source: Security
Event Category: Account Logon
Event ID: 677
Date: 7/23/2004
Time: 5:38:36 PM
User: NT AUTHORITY\SYSTEM
Computer: Server
Description:
Service Ticket Request Failed:
User Name: Server$
User Domain: WHITFIELDOIL.COM
Service Name: krbtgt/WHITFIELDOIL.COM
Ticket Options: 0x2
Failure Code: 0x20
Client Address: 127.0.0.1


Event Type: Failure Audit
Event Source: Security
Event Category: Logon/Logoff
Event ID: 529
Date: 7/24/2004
Time: 1:16:37 AM
User: NT AUTHORITY\SYSTEM
Computer: Server
Description:
Logon Failure:
Reason: Unknown user name or bad password
User Name: administrator
Domain: Server
Logon Type: 2
Logon Process: Advapi
Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Workstation Name: Server

 

[Mark-Allen]

I get these when a user or process on a system somewhere in the domain has tried to connect to my system. Most times it is a rouge process trying to update scripts or programs, etc.

Normally, I send a copy of the text to the security people who contact the person at the noted workstation and tell them not to run scripts or programs which check every machine on every domain in the world.

Check with your security people on what to do.

--
Mark-Allen Perry
ALPHA Systems, Switzerland
mark-allen AT mvps DOT org

I have been geeting the fallowing errors often in my security log. The first
dealing with Kerberos and the second concern me the most. I am running
certificates


Event Type: Failure Audit
Event Source: Security
Event Category: Logon/Logoff
Event ID: 537
Date: 7/22/2004
Time: 6:05:08 PM
User: NT AUTHORITY\SYSTEM
Computer: CONAN
Description:
Logon Failure:
Reason: An unexpected error occurred during logon
User Name:
Domain:
Logon Type: 3
Logon Process: Kerberos
Authentication Package: Kerberos
Workstation Name: -


Event Type: Failure Audit
Event Source: Security
Event Category: Account Logon
Event ID: 677
Date: 7/23/2004
Time: 5:38:36 PM
User: NT AUTHORITY\SYSTEM
Computer: Server
Description:
Service Ticket Request Failed:
User Name: Server$
User Domain: WHITFIELDOIL.COM
Service Name: krbtgt/WHITFIELDOIL.COM
Ticket Options: 0x2
Failure Code: 0x20
Client Address: 127.0.0.1


Event Type: Failure Audit
Event Source: Security
Event Category: Logon/Logoff
Event ID: 529
Date: 7/24/2004
Time: 1:16:37 AM
User: NT AUTHORITY\SYSTEM
Computer: Server
Description:
Logon Failure:
Reason: Unknown user name or bad password
User Name: administrator
Domain: Server
Logon Type: 2
Logon Process: Advapi
Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Workstation Name: Server