[Last Call] Learn how to a build a cloud-first strategyRegister Now

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 920
  • Last Modified:

On a Windows XP PC seeing Security Event 529 logon failures along with cooresponding "122 KRB Error: KRB5KDC_ERR_C_PRINCIPAL_UNKNOWN" Wireshark packets

Seeing spurts of Event ID 529 logon failures on a workstation at a remote office. An example of one of the events is included below. We will see the better part of several hundred per day and the time ranges vary when they appear. The username on a large number of these events show "administrator" or "admin" and other times show random user names. This has all the appearances of a dictionary attack and we originally found this via an audit of our Domain Controller security logs. The computer name listed on the event ID's always indicate the local computer name.

We have run various anti-virus and anti-spyware applications on the workstation but all have come up clean.

Event Type:      Failure Audit
Event Source:      Security
Event Category:      Logon/Logoff
Event ID:      529
Date:            9/30/2011
Time:            8:44:43 AM
User:            NT AUTHORITY\SYSTEM
Computer:      "WORKSTATION NAME"
Description:
Logon Failure:
       Reason:            Unknown user name or bad password
       User Name:      david
       Domain:            "DOMAIN NAME"
       Logon Type:      10
       Logon Process:      User32  
       Authentication Package:      Negotiate
       Workstation Name:      "WORKSTATION NAME"

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.


Installed Wireshark and have matched up activity from the captured packet dumps to the event ID failures
0
haloexpertsexchange
Asked:
haloexpertsexchange
1 Solution
 
yasserdCommented:
The login attemps are from a remote machine. That's what logon "type 10" means. The workstation name could mean the workstaion where the event occured. So, you need to investigate.

http://www.windowsecurity.com/articles/Logon-Types.html

http://technet.microsoft.com/en-us/library/cc765981(WS.10).aspx
0

Featured Post

Technology Partners: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

Tackle projects and never again get stuck behind a technical roadblock.
Join Now