Re: Weird Windows logon attempts

On Mon, Feb 24, 2003 at 01:27:54PM +1300, Harry Hoffman wrote:

>We have just setup ntsyslog from sourceforge.net. Our security policy is to

[...]

>Feb 22 13:27:49 exchange.auckland.ac.nz/exchange.auckland.ac.nz
>security[failure] 681 NT AUTHORITY\SYSTEM The logon to account: USERNAME by:
>MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 from workstation: G731-220-4 failed. The
>error code was: 3221225572

>Feb 22 13:27:49 exchange.auckland.ac.nz/exchange.auckland.ac.nz
>security[failure] 681 NT AUTHORITY\SYSTEM The logon to account: USERNAME by:
>MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 from workstation: G731-220-4 failed. The
>error code was: 3221225572

Hi Harry,

Although I don't exactly know the details about the NT Authentication process, the following document might help to answer your question.

Do you need help?

In addition to our free technical library, Pantek provides professional IT services to companies who utilize Open Source software: Learn more about Pantek's Technical Support offerings Place an order for 24/7/365 Technical Support here Learn more about Pantek, who we are, and what we do Chat with a Live Operator Related securityfocus.com Links bugtraq certification focus-bsd focus-ids focus-ih focus-linux focus-ms focus-sun focus-unix-other focus-virus forensics incidents libnet linux-secnews ms-secnews pen-test secpapers secprog sectools secureshell security-basics securityjobs sf-news vuln-dev webappsec Request more information about Pantek

  https://www.sans.org/rr/win2000/audit_w2k.php   Auditing the Windows 2000 Authentication Process   Julio Silveira, April 1, 2001

Good luck,

Jacco Tunnissen

-- 
http://www.honeypots.net/
Honeypot & IDS Resources

----------------------------------------------------------------------------

Lose another weekend managing your IDS?
Take back your personal time.
15-day free trial of StillSecure Border Guard.
<A href="http://www.securityfocus.com/stillsecure"> http://www.securityfocus.com/stillsecure </A>