I see the following logged on the security log of an xp system.
Event ID: 529
Reason: Unknown user name or bad password.
User Name: 1A
Logon Type: 2
Authentication Package: Negotiate
Workstation Name: XPSystem
It appears to me that the domain user is logging on to this system typing the password together with the username.
I am puzzled as to why I would see Joejj21~Bcd in the Domain field instead of our domain name. Is someone trying to access another domain or is this a bug in Microsoft?
Ive seen where one of our users types their username and password together but this shows up on the User Name field not on the Domain field.
I hope you can help me with this.
I also see Event ID 537 with the same User Name: 1A and Domain: Joejj21~Bcd when Event ID 529 occurred.