680 & 529 Failure Audits

[TH]

Archived from groups: microsoft.public.win2000.security (More info?)

We have a web server (win2k server) that has a local
account ASPNET on it that continuously tries to access
resources on a sql server (win2k advanced server). This
causes many 680 & 529 alerts to be generated from the sql
server. I have checked and there are no drive mappings or
anything on the web server to the sql server. Our web team
has looked into the issue and can't figure anything out. I
am wondering if anyone has seen anything like this and
might have a suggestion. Sample failure events are as
follows. Thanks in advance for any help.

Event Type: Failure Audit
Event Source: Security
Event Category: Account Logon
Event ID: 680
Date: 9/8/2004
Time: 5:03:41 PM
User: NT AUTHORITY\SYSTEM
Computer: SQL Server
Description:
Logon attempt by:
MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon account: ASPNET
Source Workstation: Web Server
Error Code: 0xC0000064
___________________________________________________________
Event Type: Failure Audit
Event Source: Security
Event Category: Logon/Logoff
Event ID: 529
Date: 9/8/2004
Time: 5:03:43 PM
User: NT AUTHORITY\SYSTEM
Computer: SQL Server
Description:
Logon Failure:
Reason: Unknown user name or bad password
User Name: ASPNET
Domain: Web Server
Logon Type: 3
Logon Process: NtLmSsp
Authentication Package: NTLM
Workstation Name: Web Server
Caller User Name: -
Caller Domain: -
Caller Logon ID: -
Caller Process ID: -
Transited Services: -
Source Network Address:
Source Port: 0

 

[Guest]

Archived from groups: microsoft.public.win2000.security (More info?)

I don't think this has anything to do with the web server. We have got the
same problem on a Webserver. Suddenly the errors appeared. In the evnntlog of
the webserver we get the sam errors with the ASPNET account appearinmg to be
locked when trying to access the Webservers filesystem. We have not found the
problem. Any suggestions?

"TH" wrote:

> We have a web server (win2k server) that has a local
> account ASPNET on it that continuously tries to access
> resources on a sql server (win2k advanced server). This
> causes many 680 & 529 alerts to be generated from the sql
> server. I have checked and there are no drive mappings or
> anything on the web server to the sql server. Our web team
> has looked into the issue and can't figure anything out. I
> am wondering if anyone has seen anything like this and
> might have a suggestion. Sample failure events are as
> follows. Thanks in advance for any help.
>
> Event Type: Failure Audit
> Event Source: Security
> Event Category: Account Logon
> Event ID: 680
> Date: 9/8/2004
> Time: 5:03:41 PM
> User: NT AUTHORITY\SYSTEM
> Computer: SQL Server
> Description:
> Logon attempt by:
> MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
> Logon account: ASPNET
> Source Workstation: Web Server
> Error Code: 0xC0000064
> ___________________________________________________________
> Event Type: Failure Audit
> Event Source: Security
> Event Category: Logon/Logoff
> Event ID: 529
> Date: 9/8/2004
> Time: 5:03:43 PM
> User: NT AUTHORITY\SYSTEM
> Computer: SQL Server
> Description:
> Logon Failure:
> Reason: Unknown user name or bad password
> User Name: ASPNET
> Domain: Web Server
> Logon Type: 3
> Logon Process: NtLmSsp
> Authentication Package: NTLM
> Workstation Name: Web Server
> Caller User Name: -
> Caller Domain: -
> Caller Logon ID: -
> Caller Process ID: -
> Transited Services: -
> Source Network Address:
> Source Port: 0
>
>