Connect. Communicate. Collaborate. Securely.

Home » Kerio User Forums » Kerio Control » Strange: 'NTLM login failure' log-entries without NT domain authentication... ???
  •  
winkelman

Messages: 2119
Karma: 3
Send a private message to this user
I've enabled logging of 'success' and 'failure' events off the Logon/logoff category on the Firewall machine.

I get a ton of events in the Security log (in Windows Event Viewer) like this:
Quote:

Event Type: Failure Audit
Event Source: Security
Event Category: Account Logon
Event ID: 681
Date: 15-8-2005
Time: 12:10:06
User: NT AUTHORITY\SYSTEM
Computer: [[[...KWF...]]]
Description:
The logon to account: [[[...ACCOUNT-OF-LOCAL-USER...]]]
by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
from workstation: [[[...LOCAL-WORKSTATION...]]]
failed. The error code was: 3221225572


Followed by:
Quote:

Event Type: Failure Audit
Event Source: Security
Event Category: Logon/Logoff
Event ID: 529
Date: 15-8-2005
Time: 12:10:06
User: NT AUTHORITY\SYSTEM
Computer: [[[...KWF...]]]
Description:
Logon Failure:
Reason: Unknown user name or bad password
User Name: [[[...ACCOUNT-OF-LOCAL-USER...]]]
Domain: [[[...DOMAIN...]]]
Logon Type: 3
Logon Process: NtLmSsp
Authentication Package: NTLM
Workstation Name: [[[...LOCAL-WORKSTATION...]]]


(Everything between [[[... ...]]] is edited by me.)

It seems like KWF is trying to perform some kind of NTLM authentication, but I do not have enabled any NTLM or NT domain authentication or Active Directory mapping etc. in KWF. We don't even use any Microsoft Networking, but Novell Netware.

So why am I getting the above entries for all kinds of users on my LAN who Internet through the KWF?

Anybody else got something similar?
Previous Topic: KWF Future
Next Topic: VPN Client for Pocekt PC!
Goto Forum:
  


Disclaimer:
Kerio discussion forums are intended for open communication between forum members and may contain information and material posted by members which may be useful in learning about Kerio products. The discussion forums are not intended to provide technical support for any specific product. Any information implied or expressed in the discussion forums is that of the posting member. Kerio is in no way responsible for the information posted in the forums, or its accuracy. Kerio employees may participate in the discussions, but their postings do not represent an offical position of the company on any issues raised or discussed. Kerio reserves the right to monitor and maintain the forums to promote free and accurate exchange of information.

Current Time: Mon Nov 20 10:39:12 CET 2017

Total time taken to generate the page: 0.00396 seconds
.:: Contact :: Home ::.
Powered by: FUDforum 3.0.4.