|
Re: Event Viewer - Security - Reports "Failure Audit"
On Jul 2, 9:13*am, jimbo...@operamail.com wrote:
> On Wed, 2 Jul 2008 06:58:52 -0700 (PDT), abeesg...@aol.com wrote:
> >Every day I find that 6 or more people have tried to get into my
> >computer. *I have XP Home SP3; AVG 8.0; Comodo Pro Firewall.
> >These attempts are being blocked by my system, but I would like to
> >know if there is more I should do for protection. *Also, is there a
> >site where I could report these people? *Here are a couple of samples:
>
> >Event Type: Failure Audit
> >Event Source: * * * Security
> >Event Category: * * Logon/Logoff
> >Event ID: * 529
> >Date: * * * * * * * 7/2/2008
> >Time: * * * * * * * 4:43:51 AM
> >User: * * * * * * * NT AUTHORITY\SYSTEM
> >Computer: * MARY
> >Description:
> >Logon Failure:
> > * *Reason: * * * * Unknown user name or bad password
> > * *User Name: * * *administrator
> > * *Domain: * * * * 68.164.43.58
> > * *Logon Type: * * 3
> > * *Logon Process: *NtLmSsp
> > * *Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
> > * *Workstation Name: * * * IPS102201
>
> >Event Type: Failure Audit
> >Event Source: * * * Security
> >Event Category: * * Logon/Logoff
> >Event ID: * 529
> >Date: * * * * * * * 7/2/2008
> >Time: * * * * * * * 5:42:46 AM
> >User: * * * * * * * NT AUTHORITY\SYSTEM
> >Computer: * MARY
> >Description:
> >Logon Failure:
> > * *Reason: * * * * Unknown user name or bad password
> > * *User Name: * * *Administrator
> > * *Domain: * * * * 68.164.43.58
> > * *Logon Type: * * 3
> > * *Logon Process: *NtLmSsp
> > * *Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
> > * *Workstation Name: * * * HUBEIIDC-KYX6FY
>
> >Thank you for your help.
>
> Google - event id:529- Hide quoted text -
>
> - Show quoted text -
Jim, I googled before I did this posting, and I have read Microsoft's
help listings, as well. There is only one line in all of the data
which applies to my case: "Repeated error messages such as this
indicate someone is attempting to logon or find passwords by using
"dictionary".
No were can I find what I should do about these attempts. Maybe there
isn't anything I can do, but couldn't Microsoft just say so?
Another questions is: Is there a site where these attempts should be
reported?
Thank you.
|
Linear Mode
