<div>
Thanks for that,<br />
<br />
Well, I should have seen that shouldn't I... Too quick to post a question without looking at the detail.<br />
<br />
Thanks,<br />
Alan Blair.
</div>


Thanks for that,

Well, I should have seen that shouldn't I... Too quick to post a question without looking at the detail.

Thanks,
Alan Blair.

<div>
mugojava pointed out the obvious. I guess I was steering at the screen to long to see what was in front of me.
</div>


mugojava pointed out the obvious. I guess I was steering at the screen to long to see what was in front of me.

<div>
Been there, done that! &nbsp;Kinda gettin' the stares today... :) &nbsp;glad I could help.
</div>


Been there, done that!  Kinda gettin' the stares today... :)  glad I could help.

<div>
<div class="content wysiwyg-content">
I have a client who gets a lot of reported failed login attempts with no user name on their server. Is there any way I can track which PC or service these attempts come from?<br />
<br />
Server: SBS 2003<br />
<br />
Report example, (23 events for this day):<br />
--------------------------<wbr />----<br />
Reason: &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;An error occurred during logon<br />
User Name: &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<br />
Domain: &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<br />
Logon Type: &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;3<br />
Logon Process: &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Kerberos<br />
Authentication Package: &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Kerberos<br />
Workstation Name: &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;-<br />
Status code: &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;0xC000006D<br />
Substatus code: &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;0xC0000133<br />
Caller User Name: &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;-<br />
Caller Domain: &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;-<br />
Caller Logon ID: &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;-<br />
Caller Process ID: &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;-<br />
Transited Services: &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;-<br />
Source Network Address: &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;192.168.0.62<br />
Source Port: &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;3789<br />
--------------------------<wbr />----------<wbr />-<br />
<br />

</div>
</div>


I have a client who gets a lot of reported failed login attempts with no user name on their server. Is there any way I can track which PC or service these attempts come from?

Server: SBS 2003

Report example, (23 events for this day):
------------------------------
Reason:	An error occurred during logon
User Name:	 
Domain:	 
Logon Type:	3
Logon Process:	Kerberos
Authentication Package:	Kerberos
Workstation Name:	-
Status code:	0xC000006D
Substatus code:	0xC0000133
Caller User Name:	-
Caller Domain:	-
Caller Logon ID:	-
Caller Process ID:	-
Transited Services:	-
Source Network Address:	192.168.0.62
Source Port:	3789
-------------------------------------



How to troubleshoot failed login attempts on an MS Server

The Microsoft Legacy Operating System topic includes legacy versions of Microsoft operating systems prior to Windows 2000: All versions of MS-DOS and other versions developed for specific manufacturers and Windows 3/3.1, Windows 95 and Windows 98, plus any other Windows-related versions, and Windows Mobile.