How can I track where an audit comes from?
I have 4 systems – all new installed – which have many entries of event id 560 in the seclog. All systems have been checked for viruses/malware. None found. Running Windows XP Pro SP3 on these systems in a windows 2003 Server enviroment. Domain policy contains an audits for local policy. Securitelogs are filling and [...]

Answer Question   |  July 8, 2010  2:26 PM
Event ID 760, Security log, Security logs, Windows Server 2003, Windows Server Security Logs, Windows XP

Windows 2003 Security Audit: Need help blocking and tracking consistent hacker
I’ve recently taking over as Admin working part-time for a non-profit organization in addition to my full-time job. I quickly discovered that their previous IT had been stealing from them for several years and now it appears that he has been hacking into the system. It’s been rough keeping him out, since I’m still learning [...]

Answer Question   |  June 14, 2012  4:45 PM
SBS, Small Business Server, Windows Security, Windows Server 2003, Windows Server Security Audits, Windows Server Security Logs, Windows Small Business Server 2003

Numerous Windows 2003 Security Log Event from Event ID 529
Our website was recently hijacked, and in viewing the Security log I get the following Security Log Event roughly 3 times every 10 minutes: Date: 12/10/2008 Source: Security Time: 1:50:00 PM Category: Logon/Logoff Type: Failure Aud Event ID: 529 User: NT AUTHORITYSYSTEM Computer: SERVER_NAME Description: Logon Failure: Reason: Unknown user name or bad password User [...]

Answer Question   |  December 12, 2008  10:03 PM
Event ID 529, Security logs, Windows Server 2003, Windows Server Security Logs