Let me offer some additional clarification: AMFESLAN.local is my internal domain. AMSERVER and LARRYSERVER are my domain controllers.
-----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Elkins.Justin Sent: Wednesday, November 20, 2002 4:19 PM To: NT 2000 Discussions Subject: RE: Security Events Daniel, Do you have a PC on the network named AMFESLAN and AMSERVER? I don't see any of the DNS stuff you mention in your first e-mail. My guess for what it is worth. Someone wanted to log into their local admin account on a machine named amserver however the didn't change the domain to the name of their box AMSERVER instead it stayed on the real domain name of AMFESLAN. This would cause an attempt to log into the domain as administrator which should have a different password from what they have to the local box. This is familiar to an error I see a lot. If you don't know these computer names you are going to want to take this serious and find them. Don't put it past your users to install a PC without telling you. Just my $.02 � -----Original Message----- From: Daniel L. Miller [mailto:[EMAIL PROTECTED]] Sent: Wednesday, November 20, 2002 2:36 PM To: NT 2000 Discussions Subject: FW: Security Events Event Type: Failure Audit Event Source: Security Event Category: Logon/Logoff Event ID: 534 Date: 11/20/2002 Time: 9:00:00 AM User: NT AUTHORITY\SYSTEM Computer: AMSERVER Description: Logon Failure: Reason: The user has not been granted the requested logon type at this machine User Name: Administrator Domain: AMFESLAN Logon Type: 4 Logon Process: Advapi Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 Workstation Name: AMSERVER What does this mean? Daniel ------ You are subscribed as [EMAIL PROTECTED] Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe send a blank email to %%email.unsub%% ------ You are subscribed as [EMAIL PROTECTED] Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe send a blank email to %%email.unsub%% ------ You are subscribed as [email protected] Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe send a blank email to [EMAIL PROTECTED]
