Administrator account logon failures

Description


Allows reporting on all collected events from the monitored systems.
For more information on various Windows events, go to :	http://www.microsoft.com/technet/support/eventserrors.mspx

Parameters


Database Servers	All
Computers	All
Accounts	All
Sources	Security
Categories	Logon/Logoff
IDs	529, 530, 531, 532, 533, 534, 535, 536, 537, 539
Logs	Security
Types	Failure Audit
Message Search Criteria	Include events with any of the message text keywords: Administrator
Time Frame	Last 2 Month(s)
Start Date Time	2005-09-01 00:00:00
End Date Time	2005-11-01 00:00:00


Server	Date / Time	Id	Log	Type	Category	Source	Computer	Account
LOGCASTER SERVER	9/29/2005 11:08:52 AM	529	Security	Failure Audit	Logon/Logoff	Security	LOGCASTERPROD	SYSTEM
Logon Failure: Reason: Unknown user name or bad password User Name: administrator Domain: LOGCASTERPROD Logon Type: 10 Logon Process: User32 Authentication Package: Negotiate Workstation Name: LOGCASTERPROD Caller User Name: LOGCASTERPROD$ Caller Domain: SHARKS Caller Logon ID: (0x0,0x3E7) Caller Process ID: 4704 Transited Services: - Source Network Address: 192.168.0.153 Source Port: 4604								Count: 2
LOGCASTER SERVER	9/27/2005 2:51:48 PM	529	Security	Failure Audit	Logon/Logoff	Security	LOGCASTERPROD	SYSTEM
Logon Failure: Reason: Unknown user name or bad password User Name: administrator Domain: LOGCASTERPROD Logon Type: 10 Logon Process: User32 Authentication Package: Negotiate Workstation Name: LOGCASTERPROD Caller User Name: LOGCASTERPROD$ Caller Domain: SHARKS Caller Logon ID: (0x0,0x3E7) Caller Process ID: 2964 Transited Services: - Source Network Address: 192.168.0.153 Source Port: 1150								Count: 1
LOGCASTER SERVER	9/26/2005 4:00:27 PM	529	Security	Failure Audit	Logon/Logoff	Security	LOGCASTERPROD	SYSTEM
Logon Failure: Reason: Unknown user name or bad password User Name: administrator Domain: LOGCASTERPROD Logon Type: 10 Logon Process: User32 Authentication Package: Negotiate Workstation Name: LOGCASTERPROD Caller User Name: LOGCASTERPROD$ Caller Domain: SHARKS Caller Logon ID: (0x0,0x3E7) Caller Process ID: 1144 Transited Services: - Source Network Address: 192.168.0.153 Source Port: 3887								Count: 2
LOGCASTER SERVER	9/26/2005 4:00:20 PM	534	Security	Failure Audit	Logon/Logoff	Security	LOGCASTERPROD	SYSTEM
Logon Failure: Reason: The user has not been granted the requested logon type at this machine User Name: administrator Domain: RIPPLETEST Logon Type: 10 Logon Process: User32 Authentication Package: Negotiate Workstation Name: LOGCASTERPROD Caller User Name: LOGCASTERPROD$ Caller Domain: SHARKS Caller Logon ID: (0x0,0x3E7) Caller Process ID: 1144 Transited Services: - Source Network Address: 192.168.0.153 Source Port: 3887								Count: 1
LOGCASTER SERVER	9/23/2005 11:01:12 AM	529	Security	Failure Audit	Logon/Logoff	Security	LOGCASTERPROD	SYSTEM
Logon Failure: Reason: Unknown user name or bad password User Name: administrator Domain: LOGCASTERPROD Logon Type: 2 Logon Process: Advapi Authentication Package: Negotiate Workstation Name: LOGCASTERPROD Caller User Name: LOGCASTERPROD$ Caller Domain: SHARKS Caller Logon ID: (0x0,0x3E7) Caller Process ID: 1684 Transited Services: - Source Network Address: - Source Port: -								Count: 1
LOGCASTER SERVER	9/22/2005 9:53:37 AM	529	Security	Failure Audit	Logon/Logoff	Security	LOGCASTERPROD	SYSTEM
Logon Failure: Reason: Unknown user name or bad password User Name: Administrator Domain: PETERSLAPTOP Logon Type: 3 Logon Process: NtLmSsp Authentication Package: NTLM Workstation Name: PETERSLAPTOP Caller User Name: - Caller Domain: - Caller Logon ID: - Caller Process ID: - Transited Services: - Source Network Address: 192.168.0.114 Source Port: 0								Count: 8
LOGCASTER SERVER	9/20/2005 9:13:26 AM	529	Security	Failure Audit	Logon/Logoff	Security	LOGCASTERPROD	SYSTEM
Logon Failure: Reason: Unknown user name or bad password User Name: administrator Domain: LOGCASTERPROD Logon Type: 2 Logon Process: Advapi Authentication Package: Negotiate Workstation Name: LOGCASTERPROD Caller User Name: LOGCASTERPROD$ Caller Domain: SHARKS Caller Logon ID: (0x0,0x3E7) Caller Process ID: 1712 Transited Services: - Source Network Address: - Source Port: -								Count: 4
LOGCASTER SERVER	9/14/2005 1:42:02 PM	529	Security	Failure Audit	Logon/Logoff	Security	HERCULES	SYSTEM
Logon Failure: Reason: Unknown user name or bad password User Name: administrator Domain: RIPPLETEST Logon Type: 2 Logon Process: User32 Authentication Package: Negotiate Workstation Name: HERCULES								Count: 1
LOGCASTER SERVER	9/7/2005 10:37:34 AM	534	Security	Failure Audit	Logon/Logoff	Security	LOGCASTERPROD	SYSTEM
Logon Failure: Reason: The user has not been granted the requested logon type at this machine User Name: Administrator Domain: RIPPLETEST Logon Type: 10 Logon Process: User32 Authentication Package: Negotiate Workstation Name: LOGCASTERPROD Caller User Name: LOGCASTERPROD$ Caller Domain: SHARKS Caller Logon ID: (0x0,0x3E7) Caller Process ID: 2348 Transited Services: - Source Network Address: 192.168.0.153 Source Port: 2697								Count: 1
LOGCASTER SERVER	9/7/2005 10:37:24 AM	534	Security	Failure Audit	Logon/Logoff	Security	LOGCASTERPROD	SYSTEM
Logon Failure: Reason: The user has not been granted the requested logon type at this machine User Name: Administrator Domain: RIPPLETEST Logon Type: 10 Logon Process: User32 Authentication Package: Negotiate Workstation Name: LOGCASTERPROD Caller User Name: LOGCASTERPROD$ Caller Domain: SHARKS Caller Logon ID: (0x0,0x3E7) Caller Process ID: 5952 Transited Services: - Source Network Address: 192.168.0.153 Source Port: 2692								Count: 2
LOGCASTER SERVER	9/6/2005 12:33:24 PM	529	Security	Failure Audit	Logon/Logoff	Security	HERCULES	SYSTEM
Logon Failure: Reason: Unknown user name or bad password User Name: Administrator Domain: SHARKS Logon Type: 2 Logon Process: User32 Authentication Package: Negotiate Workstation Name: HERCULES								Count: 2
LOGCASTER SERVER	9/6/2005 12:32:52 PM	534	Security	Failure Audit	Logon/Logoff	Security	HERCULES	SYSTEM
Logon Failure: Reason: The user has not been granted the requested logon type at this machine User Name: Administrator Domain: RIPPLETEST Logon Type: 2 Logon Process: User32 Authentication Package: Negotiate Workstation Name: HERCULES								Count: 3