Forum

Ultimate Windows Security Forum » Security Log » 529 - Logon Failure - Unknown user name or... » Cannot corelate Caller Logon ID which is in...

Cannot corelate Caller Logon ID which is in... Expand / Collapse
Rate Topic
Display Mode
Topic Options
Author
Message
cstaubin
Posted 3/21/2011 10:44:41 AM
Forum Newbie

Forum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum Newbie

Group: Forum Members
Last Login: 3/21/2011 10:36:05 AM
Posts: 2, Visits: 0
I have multiple instances of a 529 type 3 happening in Win 2003 svr. I cannot leverage the little information that is availible in the event properties.

Caller Logon ID: (0x0,0x3E7)

Is there a ref somewhere that matches up this hex to process or user account?

Thanks for and advice you may have.

-C

Post #620
cstaubin
Posted 3/21/2011 10:45:32 AM
Forum Newbie

Forum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum Newbie

Group: Forum Members
Last Login: 3/21/2011 10:36:05 AM
Posts: 2, Visits: 0
My bad Its a 531 type 3 event not a 529.

Sorry

Post #621
RandyFranklinSmith
Posted 3/22/2011 7:50:02 PM
Expert

ExpertExpertExpertExpertExpertExpertExpertExpert

Group: Administrators
Last Login: 4/20/2009 7:57:33 AM
Posts: 326, Visits: 0
Logon ID doesn't really have much if any meaning in this event because you are not logged on yet - since it failed. 

These are the only fields that are really useful:

  • User Name:
  • Domain:
  • Logon Type:
  • Logon Process: (limited value)
  • Authentication Package: (limited value)
  • Workstation Name:

    • and

    Source Network Address

    Post #623
    « Prev Topic | Next Topic »


    Permissions Expand / Collapse

    All times are GMT -5:00, Time now is 9:33am