Tek-Tips is the largest IT community on the Internet today!

Members share and learn making Tek-Tips Forums the best source of peer-reviewed technical information on the Internet!

Register Log in
  • Congratulations Chriss Miller on being selected by the Tek-Tips community for having the most helpful posts in the forums last week. Way to Go!

Auditing Logon Failures

Status
Not open for further replies.
bluewhaleCA

bluewhaleCA

MIS
Jul 22, 2002
272
US
Could somebody tell me what the event should be in the Security log of Event Viewer ( W2K Server SP3 ) when an incorrect password is used to log on with? I had always assumed it was

Event ID: 529
Description:
Logon Failure


However I have run tests the past two days and find that the server now logs them as

Event ID: 675
Description:
Pre-Authentication Failed


I ask because someone logged into the server using my password two mornings ago: I've changed the password, and checked who is a member of groups like the various Admin groups or server operators... but had not noticed this change in the description/event ID previously.


Thank You for your thoguhts.


Paul
 
Status
Not open for further replies.

Similar threads

MattM1975
  • Locked
  • Question
Domain Admin Logon 1
Replies
2
Views
351
ADB100
ADB100
andyferris
  • Locked
  • Question
DC Event logs auditing cannot be set by GPO
Replies
1
Views
332
RRankin355
RRankin355
DrB0b
  • Locked
  • Question
RDWeb server getting hit with odd logon requests....
Replies
1
Views
332
DrB0b
DrB0b
Leozack
  • Locked
  • Question
LOGON SPEED : GPO settings vs script reg import etc
Replies
3
Views
377
Leozack
Leozack
jrjetta1
  • Locked
  • Question
Failed logon script
Replies
0
Views
150
jrjetta1
jrjetta1

Part and Inventory Search

Sponsor

Back
Top