Strange Log Entry 1

[dl0rd]

Hi,

we have done a review of all our accounts recently where we enabled alot of logging aswell as disabling alot of users.

Now we have this weird problem where we get 10 audit log failures once every couple of hours (maybe 2-3 hours between them).

The entry in the log is a:
Failure Audit
Event ID: 675
Failure code: 0x18
Client Address: 127.0.0.1

Username: admin, and I know for sure that we have changed the password for this username.






at the same time in the application log we get a

Userenv
Event ID: 1000
Windows cannot determine the user or computer name. Return value (1326)



We always get both at the same time and it genereates alot of logs.


Could someone help me out?

 

[markdmac]

Is admin an account you created or a renamed Administrator account?

If the latter, then verify that admin is not logged on somehwere with the old password, it may be trying to authenticate with the old password.

I hope you find this post helpful. Please let me know if it was.

Regards,

Mark

 

[DanZeMan]

You may also want to check to ensure that there are no services configured to run under this "admin" account.