Logon types question Expand / Collapse
Author
Message
Posted 8/24/2009 2:51:19 PM
Forum Member

Forum MemberForum MemberForum MemberForum MemberForum MemberForum MemberForum MemberForum Member

Group: Forum Members
Last Login: 2/24/2012 7:49:27 PM
Posts: 26, Visits: 12
Randy,

Currently we are using GFI for event log management and when I run a report on 'Failed Logins' pulling from event ID 529, under 'logon type' 99.9% of them show as 'Network'. If I run a report looking for 'interactive' there are none. Any idea why the majority of failed logins under event ID 529 show up as 'Network' with very little listed as 'interactive'?

Thanks
Post #183
Posted 8/26/2009 1:15:00 PM
Expert

ExpertExpertExpertExpertExpertExpertExpertExpert

Group: Administrators
Last Login: 4/20/2009 7:57:33 AM
Posts: 329, Visits: 0
Could be a lot of things but first place I would look is for a workstation with a persistent drive mapping using an old password for some account.  How many accounts are generating the 529s?
Post #187
Posted 10/9/2009 9:39:18 AM
Forum Newbie

Forum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum Newbie

Group: Forum Members
Last Login: 5/11/2009 1:09:42 PM
Posts: 3, Visits: 0
I am seeing a lot of failed log attempts that are reporting a logon type of 0. All of the documentation I can find tells me types 0&1 aren't used. Any idea what might be causing this?
Post #231
Posted 11/1/2009 10:31:57 PM
Forum Newbie

Forum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum Newbie

Group: Forum Members
Last Login: 11/1/2009 10:26:56 PM
Posts: 1, Visits: 0
.

hi, i have been experiencing this same kind of problem. What causes this problem?

Hubschrauber selber fliegen
Post #252
Posted 11/2/2009 8:51:58 AM
Expert

ExpertExpertExpertExpertExpertExpertExpertExpert

Group: Administrators
Last Login: 4/20/2009 7:57:33 AM
Posts: 329, Visits: 0
Could either your post some examples?  Also specify OS and SP level and type of computer: workstation, domain controller, member server.  What applications, etc.
Post #255
« Prev Topic | Next Topic »


Permissions Expand / Collapse

All times are GMT -5:00, Time now is 8:23am