The event viewer on my Windows 2k Server shows someone trying to logon every day for the past ten days. It seems the attempts occur every few seconds for about ten minutes. A few usernames are used and the error message given refers to an invalid username or password. If anyone is familiar with this kind of attack please post a reply.
Thanks

examples:
The logon to account: TsInternetUser
by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
from workstation: KUNG-73E1LAGTCD
failed. The error code was: 3221225578

The logon to account: IWAM_IXIQANBM
by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
from workstation: KUNG-73E1LAGTCD
failed. The error code was: 3221225578

You might like to try one of the security mailing lists. Someone on there may have more chance of coming across this problem and would be more likely to help you.
Example http://online.securityfocus.com/archive

Thanks for the help, I'll look into it.

sounds like an brute force attack you dont happen to be running an porn site do you kiddies are really bad bout trying to crack there way into them to get free access and did all the attacks came from the same ip or were they spoofed if they all came from the same ip the odds is pretty good he didnt know what he was doing and didnt spoof his ip so i would send the logs to the abuse center where your geting your server from they should be able to track him down for you
take care