It looks to me like maybe there is a local process (IISERVER?) that is trying to log on utilizing the administrator account. I just can't identify it.
I only have one domain - all computers are a member on that domain. I'm reasonably certain this is a configuration issue on my end - I just haven't been able to figure out what I screwed up yet. One of the things that is really driving me to find this answer is my failure to get DFS operational. I can create a DFS root, and then a root replica on my other server. But then I get errors stating that the file replication service is having a problem enabling replication. And if I a subdirectory, and attempt to browse to it via a DFS mapping, the server "freaks out" (the SYSTEM process takes over the processor and doesn't relax). Daniel -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Daniel L. Miller Sent: Thursday, November 21, 2002 9:40 AM To: NT 2000 Discussions Subject: RE: Security Events Let me offer some additional clarification: AMFESLAN.local is my internal domain. AMSERVER and LARRYSERVER are my domain controllers. -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Elkins.Justin Sent: Wednesday, November 20, 2002 4:19 PM To: NT 2000 Discussions Subject: RE: Security Events Daniel, Do you have a PC on the network named AMFESLAN and AMSERVER? I don't see any of the DNS stuff you mention in your first e-mail. My guess for what it is worth. Someone wanted to log into their local admin account on a machine named amserver however the didn't change the domain to the name of their box AMSERVER instead it stayed on the real domain name of AMFESLAN. This would cause an attempt to log into the domain as administrator which should have a different password from what they have to the local box. This is familiar to an error I see a lot. If you don't know these computer names you are going to want to take this serious and find them. Don't put it past your users to install a PC without telling you. Just my $.02 � -----Original Message----- From: Daniel L. Miller [mailto:[EMAIL PROTECTED]] Sent: Wednesday, November 20, 2002 2:36 PM To: NT 2000 Discussions Subject: FW: Security Events Event Type: Failure Audit Event Source: Security Event Category: Logon/Logoff Event ID: 534 Date: 11/20/2002 Time: 9:00:00 AM User: NT AUTHORITY\SYSTEM Computer: AMSERVER Description: Logon Failure: Reason: The user has not been granted the requested logon type at this machine User Name: Administrator Domain: AMFESLAN Logon Type: 4 Logon Process: Advapi Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 Workstation Name: AMSERVER What does this mean? Daniel ------ You are subscribed as [EMAIL PROTECTED] Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe send a blank email to %%email.unsub%% ------ You are subscribed as [EMAIL PROTECTED] Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe send a blank email to %%email.unsub%% ------ You are subscribed as [EMAIL PROTECTED] Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe send a blank email to %%email.unsub%% ------ You are subscribed as [email protected] Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe send a blank email to [EMAIL PROTECTED]
