asked on

Multiple Security login failure Event ID:529

Since early this morning there has been a login failure, with an unknown user id, about twice a minute. The ID's are changing, staring with amy, and working up alphabetical names. The ID tony is now being used.
I assume that an automated Hacking tools is being used.
I hate to assume that it will always fail.
Any suggestions?
Here is a sample of the event (valid domain name is substituted for actual domain.

Event Type:      Failure Audit
Event Source:      Security
Event Category:      Logon/Logoff
Event ID:      529
Date:            7/6/2006
Time:            8:05:06 AM
User:            NT AUTHORITY\SYSTEM
Computer:      HOUSV02
Description:
Logon Failure:
     Reason:            Unknown user name or bad password
     User Name:      tomy
     Domain:            "valid domain name"
     Logon Type:      2
     Logon Process:      IIS
     Authentication Package:      MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
     Workstation Name:      HOUSV02

ASKER CERTIFIED SOLUTION

GinEric

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

cookd47

ASKER

I suspect that you are right. HOUSV02 is the Exchange Server; we are using Outlook Web Access, which requires IIS. This is complicated by an outdated CISCO firewall that we do not have a password for. Attempts to access via console have been unsuccessful. A new Firewall is on site, and will be setup tomorrow. New servers are on order as well

GinEric

You should do a thorough sweep of that Exchange Server and look to see if it has equally attempted logins. Nothing like a good DNS log to find out where it's all coming from.