Mike Attebury 
United States
Member since
3/31/2005
Platinum Membership
Posts: 41
 |
| 3/11/2008 07:57 PM |
|
I don't really know where to begin. I hired a company to install ISA 4.0, SEP 11 and Symantec Backup Exec on our SBS 2003 SP2 box. After a nightmare install of SEP 11, I have it only providing AntiVirus and Spyware protection. Now before anyone trashes me for installing SEP 11, it's a done deal and again, I think I have it smoothed out and it seems to be playing nice with the network and not to much overhead. I also had some issues with ISA initially but these also seem to have been solved. What I am experiencing now is 18 or errors within a few seconds every hour. It seems like some local service is trying to authenticate. This is happening on the SBS box. Any clue on where I should start????
Logon Failure:
Reason: Unknown user name or bad password
User Name: Administrator
Domain: MUSICTRAVEL.LOCAL
Logon Type: 3
Logon Process: NtLmSsp
Authentication Package: NTLM
Workstation Name: MTCSBS
Caller User Name: -
Caller Domain: -
Caller Logon ID: -
Caller Process ID: -
Transited Services: -
Source Network Address: -
|
|
|
|
|
|
Kevin Da Silva
Mississauga, Canada
Member since
1/12/2008
Registered Users
Posts: 563
|
| 3/12/2008 08:41 PM |
|
Any other errors pertaining to this ir anything else for that matter?
That specific data points to a client authenicate going bad, have you checked the workstation mentioned within the error? Try turning it off and see what happens unless of course its the server. |
|
MCSE:Messaging, MCTIP, SBS Specialist |
|
|
|
Mike Attebury
United States
Member since
3/31/2005
Platinum Membership
Posts: 41
|
| 3/12/2008 09:02 PM |
|
Kevin:
Thanks for replying. Unfortunately, it looks like it is coming from the server. I see no other errors that seem to relate or occur at the same time. Is there any way to track and log services as they are running and the errors are occurring?
Mike
|
|
|
|
|
|
Mike Attebury
United States
Member since
3/31/2005
Platinum Membership
Posts: 41
|
| 3/13/2008 04:10 PM |
|
| Other things that I have noticed. The error is every hour to the minute. There are always 18 errors (all the same) there is always event 552 right before and then every other event. (552-529-525-529, ect..) and ends with 529. |
|
|
|
|
|
Marina Roos
The Netherlands
Member since
3/24/2005
Forum Admins
Posts: 12290
|
| 3/13/2008 06:33 PM |
|
Hi Mike,
What services are running with the admin account and which programs are using the admin account? You should check the programs that have been added on this as well as other events logged in the eventlogs at the same time you are getting the error in the security log.
|
|
| Marina Roos Smallbizserver.Net Administrator | Mission accomplished. We have joined the branch office to our SBS 2003 Headquarters and have the same user experience on the branch office as we have on our local network at the Headquarters. Want to know how? Signup up for a subscription and get instant access to the article series 'How to add an additional Domain Controller from a remote office to the SBS domain' |
|
|
|
|
Mike Attebury
United States
Member since
3/31/2005
Platinum Membership
Posts: 41
|
| 3/13/2008 07:04 PM |
|
Hi Marina:
There are no other events in any of the logs that seem to relate or coincide , other than the 552 errors that site PID 3319 (tcpsvcs.exe-DHCP Server) before each of the 529 errors. I'm sure it has something to do with Endpoint 11, Symantec backup exec or ISA 2004, but I cannot find any of their related services running under Administrator.
Mike |
|
|
|
|
|
Marina Roos
The Netherlands
Member since
3/24/2005
Forum Admins
Posts: 12290
|
|
Mike Attebury
United States
Member since
3/31/2005
Platinum Membership
Posts: 41
|
| 3/14/2008 02:08 PM |
|
| The people that have installed the program have looked into it and are clueless (can't find good help theses days), Symantec has been no help. |
|
|
|
|
|
Mick Malloy
Australia
Member since
4/6/2007
Microsoft MVP
Posts: 287
|
| 3/15/2008 08:05 AM |
|
Stop the DHCP Server service on the server just before the errors are due, do they happen?
or simply restart the DHCP service, do they happen?
NOTE: only suggesting this because of the mention of PID 3319 (tcpsvcs.exe-DHCP Server) |
|
|
|
|
|
Mike Attebury
United States
Member since
3/31/2005
Platinum Membership
Posts: 41
|
| 3/24/2008 01:23 PM |
|
Mick:
Sorry for the slow response, I was out of the country for a week with limited access to email. I will try and stopping DHCP and see if that indeed is the problem.
Thanks,
Mike
|
|
|
|
|
|
Mike Attebury
United States
Member since
3/31/2005
Platinum Membership
Posts: 41
|
| 3/24/2008 04:38 PM |
|
Well it appears that the DHCP Server is generating these errors. Stopping the service stops these errors. What can be done here and why is this happening?
Mike
|
|
|
|
|
|
Mick Malloy
Australia
Member since
4/6/2007
Microsoft MVP
Posts: 287
|
| 3/24/2008 10:57 PM |
|
| Check the DHCP credentials. SBS console, advanced management, computer management, services and applications, rt-clk DHCP, properties, advanced tab, credentials |
|
|
|
|
|
Mike Attebury
United States
Member since
3/31/2005
Platinum Membership
Posts: 41
|
| 3/26/2008 12:02 AM |
|
Mick:
Thanks for your help! There was something weird with the DHCP and AD and when I accessed the DHCP from the sbs console, changed the credentials, it seemed to correct the errors. It has been several hours now and no errors,YEA!
I hope this does it. Unless the errors star up again, I believe it is fixed!
Thanks again,
Mike
|
|
|
|
|
|
Mick Malloy
Australia
Member since
4/6/2007
Microsoft MVP
Posts: 287
|
| 3/26/2008 10:05 PM |
|
| Excellent, and tks for letting me know. I wasn't sure on it and it was only the PID that steered me this way. |
|
|
|
|
|