On 2/28/06, Susan Bradley <[EMAIL PROTECTED]> wrote: > What's the security log say up on the server? > The security log has several of these:
Event ID 529 Source: Security Category: Logon/Logoff Type: Failure User: NT AUTHORITY\SYSTEM Computer: SBS-DC Reason: Unknown user name or bad password Username: j.bloggs Domain: PC004 Logon Type: 3 Logon Process: NtLmSsp Authentication Package: NTLM Workstation Name: PC004 And some of these: Event ID: 681 Source: Security Category: Account Logon Type: Failure User: NT AUTHORITY\SYSTEM Computer: SBS-DC The logon to account j.bloggs by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 from workstation: PC004 failed. The error code was: 3221225578 (I looked that up, and the error code apparently means 'wrong password') And some of these: Event ID: 539 Source: Security Category: Logon/Logoff Type: Failure User: NT AUTHORITY\SYSTEM Computer: SBS-DC Reason: Account locked out User Name: j.bloggs Domain: PC004 Logon Type: 3 Logon Process: NtLmSsp Authentication Package: NTLM Workstation Name: PC004 Thanks for the mention of the lockout tools - will give them a go. Cheers, -- AdamT 'Thank-you for not requesting read receipts' List info : http://www.activedir.org/List.aspx List FAQ : http://www.activedir.org/ListFAQ.aspx List archive: http://www.mail-archive.com/activedir%40mail.activedir.org/
