Failed AT jobs should also be writing to the Event Log. Ken
-----Original Message----- From: James Gregg [mailto:[EMAIL PROTECTED]] Sent: Friday, November 22, 2002 1:44 AM To: NT 2000 Discussions Subject: Re: Security Events Look at your scheduled tasks / AT jobs on this server and find out if there is a batch job running which is trying to log on as Administrator. Check to see if the job is failing. http://support.microsoft.com/default.aspx?scid=KB;en-us;q174073 Logon Type "Logon Type" will be one of the following: 2 Interactive 3 Network 4 Batch 5 Service 6 Proxy 7 Unlock Workstation (0 & 1 are invalid) ----- Original Message ----- From: "Ed Esgro" <[EMAIL PROTECTED]> To: "NT 2000 Discussions" <[EMAIL PROTECTED]> Sent: Thursday, November 21, 2002 6:01 AM Subject: RE: Security Events > The system account of the AMSERVER machine is trying to launch an API or > something. It looks like it is failing because it does not have the logon > locally right. Did somebody modify the local system account on this machine? > > -----Original Message----- > From: Daniel L. Miller [mailto:[EMAIL PROTECTED]] > Sent: Wednesday, November 20, 2002 4:36 PM > To: NT 2000 Discussions > Subject: FW: Security Events > > Event Type: Failure Audit > Event Source: Security > Event Category: Logon/Logoff > Event ID: 534 > Date: 11/20/2002 > Time: 9:00:00 AM > User: NT AUTHORITY\SYSTEM > Computer: AMSERVER > Description: > Logon Failure: > Reason: The user has not been granted the requested > logon type at this machine > User Name: Administrator > Domain: AMFESLAN > Logon Type: 4 > Logon Process: Advapi > Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 > Workstation Name: AMSERVER > > What does this mean? > > Daniel > > > ------ > You are subscribed as [EMAIL PROTECTED] > Archives: http://www.swynk.com/sitesearch/search.asp > To unsubscribe send a blank email to %%email.unsub%% > > > > > > *****This email and any files transmitted with it are confidential and > intended solely for the use of the addressee. If you have received this > email in error please notify [EMAIL PROTECTED] Any views or opinions > presented in this email are solely those of the author and do not > necessarily represent those of Stainsafe Inc. or any of its subsidiaries or > affiliates. The company accepts no liability for any damage caused by any > virus transmitted by this email.***** > > ------ > You are subscribed as [EMAIL PROTECTED] > Archives: http://www.swynk.com/sitesearch/search.asp > To unsubscribe send a blank email to %%email.unsub%% > ------ You are subscribed as [EMAIL PROTECTED] Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe send a blank email to %%email.unsub%% ------ You are subscribed as [email protected] Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe send a blank email to [EMAIL PROTECTED]
