Event ID: 529 and Event ID: 537

Posted on 2007-10-09
Last Modified: 2013-12-04
I see the following logged on the security log of an xp system.      

Event ID: 529
Logon Failure
Reason: Unknown user name or bad password.
User Name: 1A
Domain: Joejj21~Bcd
Logon Type: 2
logon Process:
Authentication Package: Negotiate
Workstation Name: XPSystem

It appears to me that the domain user is logging on to this system typing the password together with the username.

I am puzzled as to why I would see Joejj21~Bcd in the Domain field instead of our domain name.  Is someone trying to access another domain or is this a bug in Microsoft?

Ive seen where one of our users types their username and password together but this shows up on the User Name field not on the Domain field.

I hope you can help me with this.

I also see Event ID 537 with the same User Name: 1A and Domain: Joejj21~Bcd when Event ID 529 occurred.

Question by:katmg
    LVL 52

    Expert Comment

    Joejj21~Bcd - is that the computer name maybe? That would be called the local domain.

    Author Comment

    No.  For example, Joej will be the user name and j21~Bcd would seem to be the password.  It would not be the name of the workstation nor the name of our domain.

    Author Comment

    Apparently, one of our users was login in from a workstation with her domain account and accidentally entered her password together with her user name on the User Name field ex. Joejj21~Bcd.  Why would Joejj21~Bcd show up on the Domain field?


    Author Comment

    Why would Joejj21~Bcd show up on the Domain field?  I have not gotten a reply on this question.  If you can help, I would really appreciate it.  If not, let me know and I will remove it.

    LVL 52

    Accepted Solution

    Hi, I'm back from a long journey - sorry, no idea.

    Author Closing Comment

    Did not know the answer to my problem.

    Author Comment

    No answer to this question.

    Write Comment

    Please enter a first name

    Please enter a last name

    We will never share this with anyone.

    Featured Post

    Free Trending Threat Insights Every Day

    Enhance your security with threat intelligence from the web. Get trending threat insights on hackers, exploits, and suspicious IP addresses delivered to your inbox with our free Cyber Daily.

    SHARE your personal details only on a NEED to basis. Take CHARGE and SECURE your IDENTITY. How do I then PROTECT myself and stay in charge of my own Personal details (and) - MY own WAY...
    Container Orchestration platforms empower organizations to scale their apps at an exceptional rate. This is the reason numerous innovation-driven companies are moving apps to an appropriated datacenter wide platform that empowers them to scale at a …
    In this seventh video of the Xpdf series, we discuss and demonstrate the PDFfonts utility, which lists all the fonts used in a PDF file. It does this via a command line interface, making it suitable for use in programs, scripts, batch files — any pl…
    In this tutorial you'll learn about bandwidth monitoring with flows and packet sniffing with our network monitoring solution PRTG Network Monitor ( If you're interested in additional methods for monitoring bandwidt…

    794 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    16 Experts available now in Live!

    Get 1:1 Help Now