Currently we have a Windows 2003 Domain along with multiple Workgroups to segregate workstations and are running a mix of XP and 2000 boxes. Recently we began notiicing that when the Workgroup PC are printing they are connecting to one of our Domain servers and causing an authentication failure. I can reproduce the issue by bringing up a print dialog box on any of the workgroup PC's and they will trigger a NTLM connection failure to the domain member server. Below is a copy of the error from the security log on the server. So far the only remedy i have been able to find is to disable NetBIOS over TCPIP in Windows XP, i have not yet tested on a 2000 box. If turning off NetBIOS is the answer thats fine it doesnt really affect anything we are doing at this point however I'm very interested in knowing why these workgroup PC's are trying to connect to this server in particular since there is no shared printer off the server that is being connected to or any shared resources. ANy help would be appreciated.
Event Type: Failure Audit
Event Source: Security
Event Category: Logon/Logoff
Event ID: 529
Date: 5/8/2008
Time: 10:47:10 AM
User: NT AUTHORITY\SYSTEM
Computer: MACHINENAME
Description:
Logon Failure:
Reason: Unknown user name or bad password
User Name: Administrator
Domain: C0011
Logon Type: 3
Logon Process: NtLmSsp
Authentication Package: NTLM
Workstation Name: C0011
Caller User Name: -
Caller Domain: -
Caller Logon ID: -
Caller Process ID: -
Transited Services: -
Source Network Address: 192.168.21.192
Source Port: 0
For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Start Free Trial
