Results 1 to 3 of 3
  1. #1

    been getting this error lately

    We have seen a tremendous increase for this error on the Event Viewer for one of our Windows 2000 server.

    Below is the exact error; is this a hacker trying to log in?? If yes, how do we find it??

    Event Type: Warning
    Event Source: W3SVC
    Event Category: None
    Event ID: 100
    Date: 8/22/2002
    Time: 3:34:24 PM
    User: N/A
    Computer: SERVERXXXX (we changed this)
    The server was unable to logon the Windows NT account 'michael.h.lam' due to the following error: Logon failure: unknown user name or bad password. The data is the error code.
    For additional information specific to this message please visit the Microsoft Online Support site located at:
    0000: 2e 05 00 00 ....

    What should we do or look for to find the person doing this?? We would like to find the person and block them out of our servers.

    Any help is appreciated; thanks.
    Last edited by frontserve; 09-04-2002 at 09:50 PM.

  2. #2
    Join Date
    May 2001
    Prince Edward Island

    Sounds like some one is trying an exploit... check your logs for connections at the same time the event is giving the error.

    To fix, you can try:
    [url]I got nothing/url]

    For clarity's sake, don't use "<ip address of hostname>" use the ACTUAL 32-bit numeric IP address of the machine.

  3. #3
    We had that problem before, just deploy the lockdown tool by microsoft.

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts