Re: Pre-authentication events logged, but not lock-out or auth failure

I am unfamiliar with this specific issue, but I did some research and hear
are a couple of things to review:

http://support.microsoft.com/kb/328570

http://www.eventid.net/display.asp?e...curity&phase=1

--
Paul Bergson
MVP - Directory Services
MCTS, MCT, MCSE, MCSA, Security+, BS CSci
2008, 2003, 2000 (Early Achiever), NT4
Microsoft's Thrive IT Pro of the Month - June 2009

http://www.pbbergs.com

Please no e-mails, any questions should be posted in the NewsGroup This
posting is provided "AS IS" with no warranties, and confers no rights.

"cmhnz" <> wrote in message
news:...
>
> Hi all,
>
> We've discovered that we are not receiving any event ID's 529, 531, 532
> or 544 on our domain controllers. These identify username/password
> failure, account expired/disabled/locked out.
>
> Instead, we're receiving pre-authentication failure events (ID 675)
> with various Failure Codes which identify what the failure relates to.
> This started happening a couple of months ago but has only just come to
> light, and we're unsure why. Failed logon attempts directly to the
> domain controllers are logged with the specific ID (529 etc), but are
> logged as ID 675 on any other workstation/server on the domain.
>
> To my knowledge, no changes were implemented when this started
> occurring, and although it appears failed logons are getting logged as
> pre-authentication failures, this isn't ideal as we use GFI
> EventsManager to report on failed logins and really need the events
> logged as their specific ID's (529, 531 etc).
>
> Any help greatly appreciated.
>
> Cheers,
> Chris
>
>
> --
> cmhnz
> ------------------------------------------------------------------------
> cmhnz's Profile: http://forums.techarena.in/members/151326.htm
> View this thread: http://forums.techarena.in/active-directory/1266595.htm
>
> http://forums.techarena.in
>