Solved

On a Windows XP PC seeing Security Event 529 logon failures along with cooresponding "122 KRB Error: KRB5KDC_ERR_C_PRINCIPAL_UNKNOWN" Wireshark packets

Posted on 2011-09-30
1
896 Views
Last Modified: 2012-05-12
Seeing spurts of Event ID 529 logon failures on a workstation at a remote office. An example of one of the events is included below. We will see the better part of several hundred per day and the time ranges vary when they appear. The username on a large number of these events show "administrator" or "admin" and other times show random user names. This has all the appearances of a dictionary attack and we originally found this via an audit of our Domain Controller security logs. The computer name listed on the event ID's always indicate the local computer name.

We have run various anti-virus and anti-spyware applications on the workstation but all have come up clean.

Event Type:      Failure Audit
Event Source:      Security
Event Category:      Logon/Logoff
Event ID:      529
Date:            9/30/2011
Time:            8:44:43 AM
User:            NT AUTHORITY\SYSTEM
Computer:      "WORKSTATION NAME"
Description:
Logon Failure:
       Reason:            Unknown user name or bad password
       User Name:      david
       Domain:            "DOMAIN NAME"
       Logon Type:      10
       Logon Process:      User32  
       Authentication Package:      Negotiate
       Workstation Name:      "WORKSTATION NAME"

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.


Installed Wireshark and have matched up activity from the captured packet dumps to the event ID failures
0
Comment
Question by:haloexpertsexchange
1 Comment
 
LVL 10

Accepted Solution

by:
yasserd earned 500 total points
ID: 36898766
The login attemps are from a remote machine. That's what logon "type 10" means. The workstation name could mean the workstaion where the event occured. So, you need to investigate.

http://www.windowsecurity.com/articles/Logon-Types.html

http://technet.microsoft.com/en-us/library/cc765981(WS.10).aspx
0

Featured Post

U.S. Department of Agriculture and Acronis Access

With the new era of mobile computing, smartphones and tablets, wireless communications and cloud services, the USDA sought to take advantage of a mobilized workforce and the blurring lines between personal and corporate computing resources.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

The term "Bad USB" is a buzz word that is usually used when talking about attacks on computer systems that involve USB devices. In this article, I will show what possibilities modern windows systems (win8.x and win10) offer to fight these attacks wi…
If you thought ransomware was bad, think again! Doxware has the potential to be even more damaging.
This Micro Tutorial demonstrates using Microsoft Excel pivot tables, how to reverse engineer competitors' marketing strategies through backlinks.
Email security requires an ever evolving service that stays up to date with counter-evolving threats. The Email Laundry perform Research and Development to ensure their email security service evolves faster than cyber criminals. We apply our Threat…

773 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question