| Home | Register | Members | Search | Windows Vista Tips | File Database | Links |
 |
| Thread Tools | Display Modes |
|
Guest
Posts: n/a
|
|
|
|
||
|
|
| |
|
Guest
Posts: n/a
|
|
|
|
|
||
|
Guest
Posts: n/a
|
|
|
|
|
||
|
Guest
Posts: n/a
|
Russ - this is happening on the server itself, the server is the DC (SBS2003)
with 8 computers connecting to it. Bill - nothing running on the sched. task....  any other suggestions as to how to find traces of a user that has been deleted??? "Bill Sanderson" wrote: > Checked for scheduled tasks at the time the error is generated? > > "GX" wrote in message > news:948E35CC-8CA4-45D8-9801-... > > Ok...so I used to have this user setup on this SBS2003 server. The user is > gone and removed from the Users on the server. His profile is deleted from > the server, there are no services attached to his account, and no registry > keys with his username in it. Now, everyday I get this error at the same > time.... > > How can I find this user on the server and get rid of it???? > > Event Type: Failure Audit > Event Source: Security > Event Category: Logon/Logoff > Event ID: 529 > Date: 6/24/2010 > Time: 11:15:16 AM > User: NT AUTHORITY\SYSTEM > Computer: SERVERNAME > Description: > Logon Failure: > Reason: Unknown user name or bad password > User Name: treibling > Domain: servername > Logon Type: 3 > Logon Process: NtLmSsp > Authentication Package: NTLM > Workstation Name: SERVERNAME > Caller User Name: - > Caller Domain: - > Caller Logon ID: - > Caller Process ID: - > Transited Services: - > Source Network Address: - > Source Port: - > > > For more information, see Help and Support Center at > http://go.microsoft.com/fwlink/events.asp. > > . > |
|
|
|
|
|||
|
Guest
Posts: n/a
|
What Bill means (If I may)
That it sounds like a "Scheduled" Service that is running, but Failing, because the password is wrong. (That What I think he means) Russ -- Russell Grover - SBITS.Biz [SBS-MVP] MCP, MCPS, MCNPS, SBSC Remote Small Business Server/Computer Support - www.SBITS.Biz BPOS - Microsoft Online Services - www.BPOSMadeEasy.com Easy Redirect to Microsoft's New SBS Public Forum - www.SBSRepair.com "GX" <> wrote in message news:B73C3883-D2E0-4AB4-A120-... > Russ - this is happening on the server itself, the server is the DC > (SBS2003) > with 8 computers connecting to it. > Bill - nothing running on the sched. task.... > > any other suggestions as to how to find traces of a user that has been > deleted??? > > "Bill Sanderson" wrote: > >> Checked for scheduled tasks at the time the error is generated? >> >> "GX" wrote in message >> news:948E35CC-8CA4-45D8-9801-... >> >> Ok...so I used to have this user setup on this SBS2003 server. The user >> is >> gone and removed from the Users on the server. His profile is deleted >> from >> the server, there are no services attached to his account, and no >> registry >> keys with his username in it. Now, everyday I get this error at the same >> time.... >> >> How can I find this user on the server and get rid of it???? >> >> Event Type: Failure Audit >> Event Source: Security >> Event Category: Logon/Logoff >> Event ID: 529 >> Date: 6/24/2010 >> Time: 11:15:16 AM >> User: NT AUTHORITY\SYSTEM >> Computer: SERVERNAME >> Description: >> Logon Failure: >> Reason: Unknown user name or bad password >> User Name: treibling >> Domain: servername >> Logon Type: 3 >> Logon Process: NtLmSsp >> Authentication Package: NTLM >> Workstation Name: SERVERNAME >> Caller User Name: - >> Caller Domain: - >> Caller Logon ID: - >> Caller Process ID: - >> Transited Services: - >> Source Network Address: - >> Source Port: - >> >> >> For more information, see Help and Support Center at >> http://go.microsoft.com/fwlink/events.asp. >> >> . >> |
|
|
|
|
|||
|
Guest
Posts: n/a
|
Well, you definitely clarified what I meant!
Service or not, I believe these are all run by the same scheduler--perhaps going to (options??) and showing hidden tasks? (Sorry, don't have s 2k3 handy to get the exact syntax) It would be an uncommon server not to have any scheduled tasks. OK --Explore Scheduled Tasks. Advanced check the AT Service account, which should be System Account, but you never know... Turn on "View hidden tasks" If you spot one that corresponds to the correct time, right click, choose properties, and look at the Run As information View Log might have relevant information as well. Specific services can have their own credentials set as well - check the "log on as" column in services.msc. "Russ (SBITS.Biz) [SBS-MVP]" wrote in message news  9173CFC-3CA2-48F8-AA80-...What Bill means (If I may) That it sounds like a "Scheduled" Service that is running, but Failing, because the password is wrong. (That What I think he means) Russ -- Russell Grover - SBITS.Biz [SBS-MVP] MCP, MCPS, MCNPS, SBSC Remote Small Business Server/Computer Support - www.SBITS.Biz BPOS - Microsoft Online Services - www.BPOSMadeEasy.com Easy Redirect to Microsoft's New SBS Public Forum - www.SBSRepair.com "GX" <> wrote in message news:B73C3883-D2E0-4AB4-A120-... > Russ - this is happening on the server itself, the server is the DC > (SBS2003) > with 8 computers connecting to it. > Bill - nothing running on the sched. task.... > > any other suggestions as to how to find traces of a user that has been > deleted??? > > "Bill Sanderson" wrote: > >> Checked for scheduled tasks at the time the error is generated? >> >> "GX" wrote in message >> news:948E35CC-8CA4-45D8-9801-... >> >> Ok...so I used to have this user setup on this SBS2003 server. The user >> is >> gone and removed from the Users on the server. His profile is deleted >> from >> the server, there are no services attached to his account, and no >> registry >> keys with his username in it. Now, everyday I get this error at the same >> time.... >> >> How can I find this user on the server and get rid of it???? >> >> Event Type: Failure Audit >> Event Source: Security >> Event Category: Logon/Logoff >> Event ID: 529 >> Date: 6/24/2010 >> Time: 11:15:16 AM >> User: NT AUTHORITY\SYSTEM >> Computer: SERVERNAME >> Description: >> Logon Failure: >> Reason: Unknown user name or bad password >> User Name: treibling >> Domain: servername >> Logon Type: 3 >> Logon Process: NtLmSsp >> Authentication Package: NTLM >> Workstation Name: SERVERNAME >> Caller User Name: - >> Caller Domain: - >> Caller Logon ID: - >> Caller Process ID: - >> Transited Services: - >> Source Network Address: - >> Source Port: - >> >> >> For more information, see Help and Support Center at >> http://go.microsoft.com/fwlink/events.asp. >> >> . >> |
|
|
|
|
|||
|
|
| |
|
| Thread Tools | |
| Display Modes | |
|
|
Similar Threads
|
||||
| Thread | Thread Starter | Forum | Replies | Last Post |
| Re: Active Directory problems/dcdiag error | kj [SBS MVP] | Windows Small Business Server | 3 | 03-24-2010 09:19 PM |
| 0x8BAD0008 | Greg Just | Windows Live Mail | 1 | 03-24-2010 07:54 AM |
| 0x8BAD0008 | Greg Just | Windows Live Mail | 0 | 03-24-2010 02:05 AM |
| Error number 80073712 | naraku4656 | Windows Update | 51 | 02-18-2010 11:36 PM |
| Re: Server2003 2008 error !! | Meinolf Weber [MVP-DS] | Active Directory | 0 | 11-26-2009 01:37 PM |
Linear Mode
