<div>
<div class="content wysiwyg-content">
I keep getting these Failure Audit message in Event Viewer on my Small Business Server. The 1st time I noticed it there were 70,000 logs with the same message with different user names. There are no users in the domain with these names and it makes me very suspicious of hacking.<br />
I cleared the events on the 8th and since then have received 27,000. Anyone know whats going on?<br />
<br />
Logon Failure:<br />
&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Reason:Unknown user name or bad password<br />
&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;User Name: &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Echotouch<br />
&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Domain:(Domain Name)<br />
&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Logon Type: &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;8<br />
&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Logon Process: IIS &nbsp; &nbsp; <br />
&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Authentication Package:MICROSOFT_AUTHENTI<wbr />CATION_PAC<wbr />KAGE_V1_0<br />
&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Workstation Name: (My Server Name)<br />
&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Caller User Name: (My Server Name)$<br />
&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Caller Domain: (Domain Name)<br />
&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Caller Logon ID:(0x0,0x3E7)<br />
&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Caller Process ID: &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;2416<br />
&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Transited Services: &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;-<br />
&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Source Network Address: &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;-<br />
&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Source Port: &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;-
</div>
</div>


I keep getting these Failure Audit message in Event Viewer on my Small Business Server. The 1st time I noticed it there were 70,000 logs with the same message with different user names. There are no users in the domain with these names and it makes me very suspicious of hacking.
I cleared the events on the 8th and since then have received 27,000. Anyone know whats going on?

Logon Failure:
 	Reason:Unknown user name or bad password
 	User Name:	Echotouch
 	Domain:(Domain Name)
 	Logon Type:	8
 	Logon Process: IIS     
 	Authentication Package:MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
 	Workstation Name: (My Server Name)
 	Caller User Name: (My Server Name)$
 	Caller Domain: (Domain Name)
 	Caller Logon ID:(0x0,0x3E7)
 	Caller Process ID:	2416
 	Transited Services:	-
 	Source Network Address:	-
 	Source Port:	-

Event ID 529 Logon type 8

Small Business Server (SBS) is a line of server operating systems targeted at small businesses by bundling the operating system with a number of other Microsoft products that would normally need to be purchased or licensed separately. The most notable inclusions are Exchange, SQL Server, SharePoint and ISA/TMG (Microsoft's firewall and proxy server).