Solved

Critical error in security log

Posted on 2006-10-24
1
320 Views
Last Modified: 2008-01-09
About once a week I get the following error in my security log:

Logon Failure:
  Reason: Unknown user name or bad password
  User Name: stephen
  Domain: ALWAYSONCS
  Logon Type: 8
  Logon Process: IIS
  Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
  Workstation Name: SERVER1
  Caller User Name: SERVER1$
  Caller Domain: ALWAYSONCS
  Caller Logon ID: (0x0,0x3E7)
  Caller Process ID: 1936
  Transited Services: -
  Source Network Address: -
  Source Port: -

The user name changes, usually not even a user on my network.  Is this a hacker trying to gain access to my network, or is it some bug in MS SBS that causes it?  If it is a hacker is there a way for me to trace where it is coming from?

Thanks.
0
Comment
Question by:tmckinney01
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
1 Comment
 
LVL 74

Accepted Solution

by:
Jeffrey Kane - TechSoEasy earned 500 total points
ID: 17875257
It could be... you can use http://www.gfi.com/downloads/downloads.aspx?pid=LANSS&lid=en to see if there are any vulnerabilities.

Also, see:  http:Q_20840915.html  for some good troubleshooting steps.

Jeff
TechSoEasy
0

Featured Post

Free Tool: Port Scanner

Check which ports are open to the outside world. Helps make sure that your firewall rules are working as intended.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Written by Glen Knight (demazter) as part of a series of how-to articles. Introduction One of the biggest consumers of disk space with Small Business Server 2008(SBS) is Windows Server Update Services, more affectionately known as WSUS. For t…
You may have discovered the 'Compatibility View Settings' workaround for making your SBS 2008 Remote Web Workplace 'connect to a computer' section stops 'working around' after a Windows 10 client upgrade.  That can be fixed so it 'works around' agai…
In an interesting question (https://www.experts-exchange.com/questions/29008360/) here at Experts Exchange, a member asked how to split a single image into multiple images. The primary usage for this is to place many photographs on a flatbed scanner…
Finding and deleting duplicate (picture) files can be a time consuming task. My wife and I, our three kids and their families all share one dilemma: Managing our pictures. Between desktops, laptops, phones, tablets, and cameras; over the last decade…

726 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question