Search: Home Bugtraq Vulnerabilities Mailing Lists Jobs Tools Beta Programs
Focus on Microsoft
RE: Auditing enabled but Logon Failures not showing up Oct 24 2003 03:42AM
thenile@ziplip.com (thenile ziplip com) (1 replies)
RE: Auditing enabled but Logon Failures not showing up Oct 25 2003 08:07AM
Frank Heyne (fh rcs urz tu-dresden de)
On 23 Oct 2003, at 20:42, thenile (at) ziplip (dot) com [email concealed] wrote:

> Step 3: Joes tries to logon on with wrong password and staright away tries
> to log on with right password, event 529 show up on DCs.

I assume even when Joe does log on with the right password first,
you get a 529 on the DC?

The reason could be:
On some earlier session, Joe did make a network connection to the DC.
This connection used another account, because a local account normally
can't connect to the DC. Joe did use the option "reconnect again..."
Now when Joe logs on again, the WS tries to reestablish the connection
to the network share, but it has no or the wrong password.

If my assumption is wrong, you really should provide the entire output of
the 529 event on the DC, as other members on the list already
suggested.

Frank Heyne

------------------------------------------------------------------------
---
FREE Whitepaper: Better Management for Network Security

Looking for a better way to manage your IP security?
Learn how Solsoft can help you:
- Ensure robust IP security through policy-based management
- Make firewall, VPN, and NAT rules interoperable across heterogeneous
networks
- Quickly respond to network events from a central console

Download our FREE whitepaper at:
http://www.securityfocus.com/sponsor/Solsoft_focus-ms_031015
------------------------------------------------------------------------
---

[ reply ]







 

Privacy Statement
Copyright 2009, SecurityFocus