Thousands of Event ID 529: Am I being hacked?

Posted on 2006-11-13
Last Modified: 2012-08-13
I came in this morning and it was reported to me that I had over two thousand security entries in the event log with ID 529, as follows -

Event Type:      Failure Audit
Event Source:      Security
Event Category:      Logon/Logoff
Event ID:      529
Date:            13/11/2006
Time:            12:24:40
User:            NT AUTHORITY\SYSTEM
Computer:      BENCOMMS
Logon Failure:
       Reason:            Unknown user name or bad password
       User Name:      BENCOMMS$
       Domain:            BENTENLOCAL
       Logon Type:      3
       Logon Process:      NtLmSsp
       Authentication Package:      NTLM
       Workstation Name:      BENCOMMS
       Caller User Name:      -
       Caller Domain:      -
       Caller Logon ID:      -
       Caller Process ID:      -
       Transited Services:      -
       Source Network Address:      -
       Source Port:      -

For more information, see Help and Support Center at

BENCOMMS is my SBS server name and is running ISA and connected to the Internet via a router.  
They appear to start at 13:06 last Friday and are still coming in now.
I have checked my Router logs and ISA logs but cannot find anything suspicious, but admittedly I do not really know what I am looking for, I cannot seem to match anything up with the event times.

I started using netstat but got confused, I assume that some of the external ip addresses listed are websites that people are currently using.

Any help would be greatly appreciated.

Note: apologies for such low point value but I cannot work out how to convert my expert points - if you can help here then I will increase value - thanks.
Question by:fuzzyfreak
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 5
  • 4

Expert Comment

ID: 17932486
BENCOMMS$ is the machine account for your DC, correct?  If so this may not be a hacking attempt at all it just may be a problem with the computer account.  Execute the following from the command-line and report any errors:

DCDIAG /s:<Your Server> /test:MachineAccount
LVL 74

Expert Comment

by:Jeffrey Kane - TechSoEasy
ID: 17932668
Since you never responded to my post here:  http:Q_22038314.html can you at least confirm that you've made those changes?  Because otherwise it's difficult to determine what's causing this.


Author Comment

ID: 17938184
Hi CharliePete00,

I ran the DCDIAG command and the test passed successfully.
Technology Partners: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

LVL 74

Expert Comment

by:Jeffrey Kane - TechSoEasy
ID: 17939154
FYI, you aren't able to become an "expert" until you reach 10,000 points.  So, you can't use the points earned until you reach that target.


Author Comment

ID: 17965621
This is still happeneing and I have discovered that it happens right before a process starts, that is to say, it happens at the same time stamp that a process starts successfully, so though it is not debilitating to the server, it is an annoyance and presumably so many events is going to affect system performance.

Points upgraded to 500.
LVL 74

Expert Comment

by:Jeffrey Kane - TechSoEasy
ID: 17967328
Ahhh... that makes sense now... your Machine Account password has gotten corrupt somehow.  Follow the steps in this KB article to repair it:


Author Comment

ID: 17990158
Hi Jeff, I ran through this article but do not understand step 2.  I only have one DC, the SBS server with the problem, so if I set the Kerberos Key Distribution Center service to manual and restart the server, where will it get its Kerberos ticket?
It then goes on to say "If you can, do not disable the domain controller that has the global catalog, unless it is experiencing problems."

So, do I set this service to manual or ignore step 2?
With this in mind, what would be the syntax of my command?

LVL 74

Accepted Solution

Jeffrey Kane - TechSoEasy earned 500 total points
ID: 17990829
Just skip those steps.  Your syntax should be something like this:

netdom resetpwd /s:BENCOMMS /ud:BENTENLOCAL\administrator /pd:*

Then, just reboot and you should be fine.


Author Comment

ID: 18006412
Thanks very much Jeff.  I've done that and am now monitoring.

Author Comment

ID: 18019669
Thanks Jeff, that worked a treat.

Featured Post

Enroll in May's Course of the Month

May’s Course of the Month is now available! Experts Exchange’s Premium Members and Team Accounts have access to a complimentary course each month as part of their membership—an extra way to increase training and boost professional development.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
FInd Local Administrators 6 57
aes256 Ransomware on SBS 2011 13 75
Using MS Hello on a Domain Joined Surface Book 4 75
Maintain demoted SBS2011 as stand alone server 5 54
Because virtualization becomes more and more common, and, with Microsoft Hyper-V included in Windows Server at no additional costs, and, most server hardware nowadays is more than capable of running a physical Small Business Server (SBS) 2008 or 201…
I’m often asked about newer and larger USB drives connected to SBS2008 and 2011 failing Windows Server Backup vs the older USB drives not failing. As disk space continues to grow and drive technology change SBS2008 and some SBS2011 end up with the f…
Nobody understands Phishing better than an anti-spam company. That’s why we are providing Phishing Awareness Training to our customers. According to a report by Verizon, only 3% of targeted users report malicious emails to management. With compan…
This video shows how to use Hyena, from SystemTools Software, to update 100 user accounts from an external text file. View in 1080p for best video quality.

751 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question