Logon type 3 and event 529

Archived from groups: microsoft.public.win2000.security (More info?)

Howdy Everyone,

I have seen a number of 529 errors in the security event log with a logon
type of 3.

Are logon type 3 only generated from inside the network or can they also be
generated from an outside connection (terminal services, Outlook Web Access,
VPN, etc).

Thanks in advance for your help.
1 answer Last reply
More about logon type event
  1. Archived from groups: microsoft.public.win2000.security (More info?)

    Terminal services for Windows 2000 is considered type 2 console logon. In Windows
    2003 I think it gets it's own logon type of 10. Other than TS, type 3 logon would be
    any logon attempt other than console/keyboard logon. Type 3 can originate from the
    internet if there is no or an improperly configured firewall as users attempt to hack
    ports such as 139 and 445 tcp. The link below is a good read on using the security
    log and intrusion detection for windows. --- Steve

    http://www.microsoft.com/technet/security/guidance/secmod144.mspx

    http://www.microsoft.com/resources/documentation/WindowsServ/2003/datacenter/proddocs/en-us/Default.asp?url=/resources/documentation/windowsserv/2003/datacenter/proddocs/en-us/518.asp

    "Bryan Bowers" <nobody@spam.com> wrote in message
    news:umToB4$cEHA.3944@tk2msftngp13.phx.gbl...
    > Howdy Everyone,
    >
    > I have seen a number of 529 errors in the security event log with a logon
    > type of 3.
    >
    > Are logon type 3 only generated from inside the network or can they also be
    > generated from an outside connection (terminal services, Outlook Web Access,
    > VPN, etc).
    >
    > Thanks in advance for your help.
    >
    >
Ask a new question

Read More

Security Microsoft Windows