RE: Account logon failed

["McGill, Lachlan" <mcgilll1 () anz com>]

Did you try www.eventid.net ?

Fantastic tool that has saved me a number of times.

-----Original Message-----
From: Alastair Cook [mailto:Alastair.Cook () crown uk com]
Sent: Friday, 22 August 2003 1:29 AM
To: security-basics () securityfocus com
Subject: Account logon failed


Hi, does anyone know what this error means, or specifically how to stop it!

I'm getting it in the security log on numerous servers in one domain from a
machine in another domain - no trust exists

---
Event Type:     Failure Audit
Event Source:   Security
Event Category: Account Logon 
Event ID:       681
Date:           21/08/2003
Time:           15:49:30
User:           NT AUTHORITY\SYSTEM
Computer:       in domain A
Description:
The logon to account: in domain b
by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
from workstation: in domain b
failed. The error code was: 3221225572
---

It looks like this machine is trying to log on to servers in one domain
using a domain account in it's own domain

Any ideas, there's not much I could find on the internet and it's driving me
nuts

Thanks, Ali

----------------------- 
This email is confidential and intended solely for the use of the individual
to whom it is addressed. Any views or opinions presented are solely those of
the author and do not necessarily represent those of Alphameric Hospitality.
If you are not the intended recipient, be advised that you received this
email in error and that any use, dissemination, forwarding, printing, or
copying of this email is strictly prohibited. If you have received this
email in error please notify the sender.


---------------------------------------------------------------------------
----------------------------------------------------------------------------


---------------------------------------------------------------------------
----------------------------------------------------------------------------