Failed Access to Shares

[BiJae]

This morning when I came in I was confronted by the users because the Win2k3 shares were not available. I have not changed anything on this server and they were working fine when I left last night.

The security logs show the following error for each attempt to access the shares:

Event Type: Failure Audit
Event Source: Security
Event Category: Logon/Logoff 
Event ID: 529
Date:  10/31/2006
Time:  7:38:06 AM
User:  NT AUTHORITY\SYSTEM
Computer: TCUD-DATA
Description:
Logon Failure:
  Reason:  Unknown user name or bad password
  User Name: 
  Domain:  
  Logon Type: 3
  Logon Process: Kerberos
  Authentication Package: Kerberos
  Workstation Name: -
  Caller User Name: -
  Caller Domain: -
  Caller Logon ID: -
  Caller Process ID: -
  Transited Services: -
  Source Network Address: 192.168.20.135
  Source Port: 0

First glance at this presents a couple of red flags: There is no user name presented in the log, There is no password, or domain information in the log either.

I am able to access the shares with my user name and login, however I have administrator privileges.

Has anyone ever seen something like this before? It's not a good way to start on All Hallows Eve.. Any help is appreciated.

Thank you

http://www.bijae.net

"If the only prayer you said in
your whole life was, 'thank you,'
that would suffice."
-- Meister Eckhart

 

[BiJae]

Addendum:

I looked through the security audit logs and found that I was getting successful file access until 12:48 AM last night. The first IP address to fail was that of my exchange server. Fromp that point on everything began to fail. Not sure if this is useful in diagnostics, but I'm trying to investigate this in a hurry so I'm giving all that I can.

Thank you,

http://www.bijae.net

"If the only prayer you said in
your whole life was, 'thank you,'
that would suffice."
-- Meister Eckhart

 

[basst]

Have the permissions on your shares been changed?

 

[BiJae]

Thank you for your response.

The permissions have not changed on the servers or the shares. I hadn't changed anything when I left yesterday.

I was able to figure out that the cause of the problem is a DNS Server located at the parent office. They are having problems with their server and it's causing my headaches. I was able to change all the shares to IP address routing and connect just fine. I changed all the shares on the PC's from \\data\share to \\192.168.154.99\share and everything came up normal.

Thank you again for your post.

http://www.bijae.net

"If the only prayer you said in
your whole life was, 'thank you,'
that would suffice."
-- Meister Eckhart