Logon Error After Admin Passwd Change

Discussion in 'Windows Small Business Server' started by D. Storme, Oct 24, 2004.

  1. D. Storme

    D. Storme Guest

    I changed the admin password on a SBS2003 Premium (SQL and ISA). After the
    change I am seeing ~ 600 (every 24 hours) entries in the security log.
    Groups of errors (~30) seem to occur during the first 2-3 minutes every
    hour. The entries looks like:

    Event Type: Failure Audit
    Event Source: Security
    Event Category: Logon/Logoff
    Event ID: 529
    Date: 10/24/2004
    Time: 6:02:32 AM
    Computer: Server 1
    Logon Failure:
    Reason: Unknown user name or bad password
    User Name: administrator
    Domain: sbs
    Logon Type: 3
    Logon Process: NtLmSsp
    Authentication Package: NTLM
    Workstation Name: Server 1
    Caller User Name: -
    Caller Domain: -
    Caller Logon ID: -
    Caller Process ID: -
    Transited Services: -
    Source Network Address: -
    Source Port: -

    I did find one location in Trend Micro that used the old password and
    changed it.

    I did change the admin password through the Server Management UI.

    Any ideas would be greatly appreciated.

    D. Storme, Oct 24, 2004
    1. Advertisements

  2. Hi D,

    Did you check all the services that are using the admin account? For
    example, SQL uses the admin account, so you should change the password there
    as well.
    Marina Roos [SBS-MVP], Oct 24, 2004
    1. Advertisements

  3. D. Storme

    D. Storme Guest

    I had set up SQL to use the system account, so I discounted that possibility
    early on.

    However, I did find the problem, yes it was Trend Micro. I had the virus
    updates set for hourly. I did change the password on the scheduled update
    page but failed to notice the update now page also had a password field.
    Changed both again, and the problems seem to have disappeared. I have
    monitored for one hour and no 529 errors.

    Thanks for the suggestions...
    D. Storme, Oct 24, 2004
    1. Advertisements

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments (here). After that, you can post your question and our members will help you out.