Failure Audit Event ID 529
Randolf
weeks now. I was not able to find a solution. This is logged into the
security log of our sbs 2k3 premium server. Of course I checked several
settings, such as services using my personal account. But so far no
good...
Can anybody help us to get rid of this anoying error?
Thx in advance.
Randolf.
Event Type: Failure Audit
Event Source: Security
Event Category: Logon/Logoff
Event ID: 529
Date: 28-6-2004
Time: 16:13:21
User: NT AUTHORITY\SYSTEM
Computer: "OurServer"
Description:
Logon Failure:
Reason: Unknown user name or bad password
User Name: "MyLoginName"
Domain:
Logon Type: 3
Logon Process: Advapi
Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Workstation Name: "OurServer"
Caller User Name: "OurServer"$
Caller Domain: "OurDomain"
Caller Logon ID: (0x0,0x3E7)
Caller Process ID: 5408
Transited Services: -
Source Network Address: -
Source Port: -
tim herglotz
Check this link:
http://support.microsoft.com/search/default.aspx?
InCC_hdn=true&Catalog=LCID%3D1033%26CDID%3DEN-US-KB%
26PRODLISTSRC%
3DON&withinResults=&QuerySource=gASr_Query&Product=msall&Q
ueryc=event+id+529&Query=event+id+529&KeywordType=ALL&maxR
esults=25&Titles=false&numDays=&InCC=on
There is allot off knowledge base articles by
microsoft.......
or go to http://support.microsoft.com
greetz,
tim
>.
>
Randolf
Thanks for your quick reply. I checked this all before. It did not
answer my question. DO you have other suggestions?
Rgds,
Randolf.
"tim herglotz" <nightwal...@hotmail.com> wrote in
news:223f601c45d28$ccbdead0$a301...@phx.gbl:
Eric Sun [MSFT]
Thanks for posting here.
Based on my research, the Event 529 was caused by the machine account password not being properly in sync. Only
attempts to login using that account and NTLM would fail. Anything other than that would work fine, including
accessing the IPC$ share.
The errors were being generated mostly by the Exchange Routing Engine, that service does start several connections
using the machine account.
The resolution was to reset the machine password by using "NETDOM RESETPWD" with the required parameters. For
the detailed steps, please refer to the following article.
325850 HOW TO: Use Netdom.exe to Reset Machine Account Passwords of a Windows
http://support.microsoft.com/?id=325850
We have not determined how the password got out of sync, but we suspect it has to do with the installation of the
server using an older date and then moving the date forward.
Please let us know if you have you have any further questions or concerns. Thanks.
Best Regards,
Eric Sun,
MCSE2000 / MSCA / MCDBA
Microsoft Partner Support Professional
Get Secure! - www.microsoft.com/security
=====================================================
When responding to posts, please "Reply to Group" via
your newsreader so that others may learn and benefit
from your issue.
=====================================================
This posting is provided "AS IS" with no warranties, and confers no rights
--------------------
| Newsgroups: microsoft.public.windows.server.sbs
| Subject: Failure Audit Event ID 529
| From: Randolf <nos...@nospam.com>
| Message-ID: <Xns9516ABC8CD55...@195.129.110.197>
| User-Agent: Xnews/5.04.25
| Date: 28 Jun 2004 14:53:49 GMT
| Lines: 37
| Organization: Novaxess
| NNTP-Posting-Host: 213.201.144.226
| X-Trace: 1088434429 news.novaxess.net 277 213.201.144.226
| X-Complaints-To: ab...@novaxess.net
| Path: cpmsftngxa10.phx.gbl!TK2MSFTFEED01.phx.gbl!TK2MSFTNGP08.phx.gbl!newsfeed00.sul.t-online.de!t-
online.de!npeer.de.kpn-eurorings.net!news.tele.dk!news.tele.dk!small.news.tele.dk!lnewsoutpeer00.lnd.ops.eu.uu.net!
lnewsinpeer00.lnd.ops.eu.uu.net!bnewsoutpeer00.bru.ops.eu.uu.net!bnewsinpeer01.bru.ops.eu.uu.net!
bnewspost00.bru.ops.eu.uu.net!emea.uu.net!news.novaxess.net!not-for-mail
| Xref: cpmsftngxa10.phx.gbl microsoft.public.windows.server.sbs:83349
| X-Tomcat-NG: microsoft.public.windows.server.sbs