Very weird Account Logging situation

[Guest]

Situation: I have 2003 AD running with XP Clients. I have some XP Laptops
not joined to the domain (waiting on VPN to avoid system lockout after x# of
logins without contacting the DC). A new system that was recently added to
the domain is receiving the account logging for a Laptop that is not on the
domain.

(e-mail address removed) is receiving account logon failure log entries for
laptop1.

laptop1 is in a "workgroup" configuration. Same network/subnet etc..

Any idea how this can be happening?

 

[Steven L Umbach]

Apparently a user that uses that laptop is trying to access the computer
that shows the failed logon attempts. The failed logon attempts should show
a user name. -- Steve

 

[Guest]

I think the situation is this:

System1 has print and file sharing on, and when the laptop user clicked on a
share, the users ID was denied because they dont have a local account on
system1. Also, the laptop1 users id is not in AD, so it didn't receive
permission from the DC.

The laptop1 user is the director of the facility, and has no desire to log
into System1, or the knowledge for that matter.

Thanks for your reply Steven!

 

[Steven L Umbach]

I agree with your assessment of why the logon failure was recorded and the
logon failure should show the users' name. If you think however that the
logon failure makes no sense then possibly their was another computer
connected to the network using the same computer name or some process
[possibly unaware to the user such as malware] is trying to access the
network share. --- Steve