Solved

Computer still contacting domain even though we removed it from domain

Posted on 2012-03-16
4
390 Views
Last Modified: 2012-03-16
We had this computer on our domain but we are redeploying it as a Kiosk machine.  The Kiosk's have no reason to be on our domain for security reasons.  I've installed SiteKiosk v8 software on this Windows 7 64bit machine.  Everything works great except when I log into the LOCAL user it appears as if the machine is still contacting our domain.  We use EventSentry and I get the following message every time I log onto this kiosk box with a local user.


EVENT #      65036788
EVENT LOG      Security
EVENT TYPE      Audit Failure
SOURCE      Security
CATEGORY      Logon/Logoff
EVENT ID      529
USERNAME      NT AUTHORITY\SYSTEM
COMPUTERNAME        -our domain controller name-
DATE / TIME        3/16/2012 9:16:29 AM
MESSAGE      Logon Failure:
Reason: Unknown user name or bad password
User Name: SiteKiosk
Domain: KIOSK2
Logon Type: 3
Logon Process: NtLmSsp
Authentication Package: NTLM
Workstation Name: KIOSK2
Caller User Name: -
Caller Domain: -
Caller Logon ID: -
Caller Process ID: -
Transited Services: -
Source Network Address: 10.1.3.162
Source Port: 0


The thing is like I said, I removed this machine from the domain. I changed it to a kiosks WORKGROUP and renamed it at the same time.  What on this machine is trying to contact the domain at logon?
0
Comment
Question by:ITdiamond
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
4 Comments
 
LVL 2

Expert Comment

by:ZachAtak
ID: 37729410
Could be a service, a mapped drive or anything else thats trying to reach a resource on your domain.
0
 
LVL 7

Accepted Solution

by:
withtu earned 500 total points
ID: 37729693
You can use NetMon to track the traffic to domain controller which will tell you that what process is connecting.
0
 

Author Comment

by:ITdiamond
ID: 37729959
Ah ok it looks like it was related to Desktop Authority Script Logic CBM Service (Computer Based Management).

We use Script Logic's Desktop Authority and I just uninstalled everything related to it.  No more errors!
0
 
LVL 7

Expert Comment

by:withtu
ID: 37730145
@ITdiamond, great news! You can also check local Group Policy results to ensure all GPO settings are restored to default.
0

Featured Post

Veeam gives away 10 full conference passes

Veeam is a VMworld 2017 US & Europe Platinum Sponsor. Enter the raffle to get the full conference pass. Pass includes the admission to all general and breakout sessions, VMware Hands-On Labs, Solutions Exchange, exclusive giveaways and the great VMworld Customer Appreciation Part

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Did you know that more than 4 billion data records have been recorded as lost or stolen since 2013? It was a staggering number brought to our attention during last week’s ManageEngine webinar, where attendees received a comprehensive look at the ma…
After seeing many questions for JRNL_WRAP_ERROR for replication failure, I thought it would be useful to write this article.
This Micro Tutorial will give you basic overview of the control panel section on Windows 7. It will depth in Network and Internet, Hardware and Sound, etc. This will be demonstrated using Windows 7 operating system.
This Micro Tutorial will give you a basic overview of Windows DVD Burner through its features and interface. This will be demonstrated using Windows 7 operating system.

630 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question