Security - 529
- Source » Security
- Event ID » 529
- Type » Failure
- Category » Logon/Logoff
- User » NT AUTHORITY\SYSTEM
- Computer » LOCALCOMPUTERNAME
- Log » Security
- Opcode »
- Keywords »
- InstanceID » 0
Description »
Logon Failure: Reason: Unknown user name or bad password User Name: sAMAccountNAme Domain: NTDOMAIN Logon Type: 7 Logon Process: User32 Authentication Package: Negotiate Workstation Name: LOCALCOMPUTERNAME Caller User Name: LOCALCOMPUTERNAME$ Caller Domain: NTDOMAIN Caller Logon ID: (0x0,0x3E7) Caller Process ID: 3544 Transited Services: - Source Network Address: 192.168.209.12 Source Port: 62260Data formatted as » None
This is the alternate failure event for event ID 528. It shows you that a logon attempt has failed, and hopefully - it will tell you the reason why (Unknown username or bad password). You may find an event with ID 680, which has an NTSTATUS value giving a more precise reason for the failure.
If relevant/known, the remote computer name/remote IP address will be listed.
The fields shown within the event description will vary according to the logon type and authentication package.