QUESTION POSED ON: 17 September 2004
My question is about frequent 680 and 529 events. We have a Web server running Win2K server that has the local user ASP.NET on it. This user is repeatedly trying to access resources on one of our SQL servers, which is running Win2K advanced server, causing the events to be generated. I have given information on the dates and times of the events coming from the SQL server to our Web team, but they can't figure out what is causing the problem. From what I could see, there are no drive mappings on the Web server to the SQL server or anything like that. Have you seen this type of thing before, or do you have any ideas what or how the ASP.NET user is trying to access the SQL server? Thanks for your time and your help. The events generated from the SQL server are as follows:
Event Type: Failure Audit
Event Source: Security
Event Category: Account Logon
Event ID: 680
Date: 9/8/2004
Time: 5:03:41 PM
User: NT AUTHORITYSYSTEM
Computer: SQL Server
Description:
Logon attempt by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon account: ASPNET
Source Workstation: Web Server
Error Code: 0xC0000064
Event Type: Failure Audit
Event Source: Security
Event Category: Logon/Logoff
Event ID: 529
Date: 9/8/2004
Time: 5:03:41 PM
User: NT AUTHORITYSYSTEM
Computer: SQL Server
Description:
Logon Failure:
Reason: Unknown user name or bad password
User Name: ASPNET
Domain: Web Server
Logon Type: 3
Logon Process: NtLmSsp
Authentication Package: NTLM
Workstation Name: Web Server
Caller User Name: -
Caller Domain: -
Caller Logon ID: -
Caller Process ID: -
Transited Services: -
Source Network Address:
Source Port: 0
|
