Windows 2003 server SP2 Domain Controller generates failure audits with the event ID's of 529 672 and 680. I have read and tried techsoeasy's solution of using netdom.exe to rename the machine account in AD but the events are still being generated at least once an hour. Text of the events is the same as that already supplied by previous questioners but I've included anyway. The domain administrator account is not administrator obviously. Has anyone else managed to find a way of fixing this problem.
Event Type: Failure Audit
Event Source: Security
Event Category: Account Logon
Event ID: 672
Date: 22/07/2008
Time: 10:43:10
User: NT AUTHORITY\SYSTEM
Computer: FHC-2K3
Description:
Authentication Ticket Request:
User Name: administrator
Supplied Realm Name: FHC
User ID: -
Service Name: krbtgt/FHC
Service ID: -
Ticket Options: 0x40810010
Result Code: 0x6
Ticket Encryption Type: -
Pre-Authentication Type: -
Client Address: 127.0.0.1
Certificate Issuer Name:
Certificate Serial Number:
Certificate Thumbprint:
For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Event Type: Failure Audit
Event Source: Security
Event Category: Logon/Logoff
Event ID: 529
Date: 22/07/2008
Time: 09:35:26
User: NT AUTHORITY\SYSTEM
Computer: FHC-2K3
Description:
Logon Failure:
Reason: Unknown user name or bad password
User Name: administrator
Domain: FHC
Logon Type: 3
Logon Process: NtLmSsp
Authentication Package: NTLM
Workstation Name: FHC-2K3
Caller User Name: -
Caller Domain: -
Caller Logon ID: -
Caller Process ID: -
Transited Services: -
Source Network Address: -
Source Port: -
For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Event Type: Failure Audit
Event Source: Security
Event Category: Account Logon
Event ID: 680
Date: 22/07/2008
Time: 09:35:26
User: NT AUTHORITY\SYSTEM
Computer: FHC-2K3
Description:
Logon attempt by: MICROSOFT_AUTHENTICATION_P
ACKAGE_V1_
0
Logon account: administrator
Source Workstation: FHC-2K3
Error Code: 0xC0000064
For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
http://www.microsoft.com/downloads/details.aspx?FamilyId=062E954C-FDEC-45AF-A09C-5A05B8F010A5&displaylang=en