Hello yaro,
If you check the logon type 7, it is screnn saver unlock and 10 is RDC:
http://www.windowsecurity.com/articles/Logon-Types.html
Are the user accounts exisiting, that are logged? Did you talk to the users
about this?
Best regards
Meinolf Weber
Disclaimer: This posting is provided "AS IS" with no warranties, and confers
no rights.
** Please do NOT email, only reply to Newsgroups
** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm
[Quoted Text] > I found them on a TS in security log. There are lots of them.
> I wouldn't suspect the users forgetting their passwords so
> often. Coming from different processes which I can't see in
> Task Manager. Also different ports. They all have the same
> caller ID. Any idea what can be causing them?
> yaro
> Logon Failure:
> Reason: Unknown user name or bad password
> User Name: Martin
> Domain: DOMAIN
> Logon Type: 7
> Logon Process: User32
> Authentication Package: Negotiate
> Workstation Name: TS
> Caller User Name: TS$
> Caller Domain: DOMAIN
> Caller Logon ID: (0x0,0x3E7)
> Caller Process ID: 5532
> Transited Services: -
> Source Network Address: 192.168.26.102
> Source Port: 1565
> Logon Failure:
> Reason: Unknown user name or bad password
> User Name: Davidm
> Domain: DOMAIN
> Logon Type: 10
> Logon Process: User32
> Authentication Package: Negotiate
> Workstation Name: TS
> Caller User Name: TS$
> Caller Domain: DOMAIN
> Caller Logon ID: (0x0,0x3E7)
> Caller Process ID: 6132
> Transited Services: -
> Source Network Address: 192.168.26.103
> Source Port: 1047
> Logon Failure:
> Reason: Unknown user name or bad password
> User Name: clayt
> Domain: DOMAIN
> Logon Type: 7
> Logon Process: User32
> Authentication Package: Negotiate
> Workstation Name: TS
> Caller User Name: TS$
> Caller Domain: DOMAIN
> Caller Logon ID: (0x0,0x3E7)
> Caller Process ID: 2412
> Transited Services: -
> Source Network Address: 192.168.36.11
> Source Port: 1042
|