Logon failure cause by svchost process, why? and who to fix

cportuguez — Thu, 10 Mar 2011 16:50:58 GMT

Hi
In the last couple of days I stared to see more events 531 recorded on my DC when I look at the Users Name the event description comes blank and the caller user name is the DC$, what I found very interesting is that the caller process ID is associated with svchost.exe when I look at the services related to that svchost I am not see any of those services running with a disable account.

Also the logon type is 3 so it is a network logon by a shared drive or IIS.

What things I can check to find the source of the failed attempts

Regards,

Windows Screen Saver Failed Logins

dsax — Tue, 21 Apr 2009 07:06:05 GMT

Hi,

Is there a way to differentiate when an account is locked due to screen saver failed logins from other locked account events?

Thanks,

dsax

UltimateWindowsSecurity.com Forum / Ultimate Windows Security Forum / Security Log / 531 - Logon Failure - Account currently disabled

Logon failure cause by svchost process, why? and who to fix

Windows Screen Saver Failed Logins