Good and Bad users

Question

Post reply

Good and Bad users

Roust_m

SSCoach

Points: 17408
More actions
August 4, 2003 at 8:47 am

#160607

Hi!
Few days ago I noticed frequent error messages on all MS SQL servers:
=====================================================================
Security:537
Logon Failure:
Reason:An unexpected error occurred during logon User Name:
Domain:
Logon Type:3
Logon Process:Kerberos
Authentication Package:Kerberos
Workstation Name:-
=====================================================================
As I figured out, this error happens when the only user logs on. This is the sequence,
when "Bad" user logs on:
Event Type:Failure Audit
Event Source:Security
Event Category:Logon/Logoff
Event ID:537
Date:04.08.2003
Time:17:07:13
User:NT AUTHORITY\SYSTEM
Computer:SQLSRV
Description:
Logon Failure:
Reason:An unexpected error occurred during logon
User Name:
Domain:
Logon Type:3
Logon Process:Kerberos
Authentication Package:Kerberos
Workstation Name:-
Event Type:Success Audit
Event Source:Security
Event Category:Privilege Use
Event ID:576
Date:04.08.2003
Time:17:07:13
User:DOMAIN.CENTER\John
Computer:SQLSRV
Description:
Special privileges assigned to new logon:
User Name:
Domain:
Logon ID:(0x0,0x101F209)
Assigned:SeChangeNotifyPrivilege
Event Type:Success Audit
Event Source:Security
Event Category:Logon/Logoff
Event ID:540
Date:04.08.2003
Time:17:07:13
User:DOMAIN.CENTER\John
Computer:SQLSRV
Description:
Successful Network Logon:
User Name:John
Domain:DOMAIN.CENTER
Logon ID:(0x0,0x101F209)
Logon Type:3
Logon Process:Kerberos
Authentication Package:Kerberos
Workstation Name:
This, how it goes, when "Good" user logs on:
Event Type:Success Audit
Event Source:Security
Event Category:Logon/Logoff
Event ID:538
Date:04.08.2003
Time:17:07:08
User:DOMAIN.CENTER\Jack
Computer:SQLSRV
Description:
User Logoff:
User Name:Jack
Domain:DOMAIN.CENTER
Logon ID:(0x0,0x101E865)
Logon Type:3
Event Type:Success Audit
Event Source:Security
Event Category:Logon/Logoff
Event ID:540
Date:04.08.2003
Time:17:07:06
User:DOMAIN.CENTER\Jack
Computer:SQLSRV
Description:
Successful Network Logon:
User Name:Jack
Domain:DOMAIN.CENTER
Logon ID:(0x0,0x101E865)
Logon Type:3
Logon Process:Kerberos
Authentication Package:Kerberos
Workstation Name:
Event Type:Success Audit
Event Source:Security
Event Category:Privilege Use
Event ID:576
Date:04.08.2003
Time:17:07:06
User:DOMAIN.CENTER\Jack
Computer:SQLSRV
Description:
Special privileges assigned to new logon:
User Name:
Domain:
Logon ID:(0x0,0x101E865)
Assigned:SeChangeNotifyPrivilege
==================================================================
The "Bad" one does not complain about any problems when logging on.
What causes these errors and how to stop them?
Thanks.
August 7, 2003 at 8:00 am

This was removed by the editor as SPAM

Viewing 3 posts - 1 through 2 (of 2 total)

You must be logged in to reply to this topic. Login to reply

brokenrulz SSCrazy Points: 2261 More actions · Answer 1

Maybe this link can help you :

http://www.windowsecurity.com/articles/Understanding_Windows_Logging.html

Relationships are like Banks.You Invest the Principal and then get the Interest.

He who knows others is learned but the wise one is one who knows himself.