Failure Audit

[Bob]

Archived from groups: microsoft.public.win2000.security (More info?)

Every ten minutes I get four hits in the DC security logs for the following:
Event Type: Failure Audit
Event Source: Security
Event Category: Account Logon
Event ID: 681
Date: 10/29/2004
Time: 10:53:41 AM
User: NT AUTHORITY\SYSTEM
Computer: MAS200
Description:
The logon to account: mooret
by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
from workstation: TIM-MOBILE
failed. The error code was: 3221225586

The mooret account is disabled, and the primary user of the Tim-Mobile
workstation used to be mooret before he left.
There are no services on the machine trying to use that account and I have
no idea what is running on that machine that is trying to logon to the DC.

How can I track it down?

Thanks, Bob

 

[Bob]

Archived from groups: microsoft.public.win2000.security (More info?)

Sorry for the multiple posts. I kept getting messages saying the post had
failed.