Logon type 3 and event 529

[Guest]

Archived from groups: microsoft.public.win2000.security (More info?)

Howdy Everyone,

I have seen a number of 529 errors in the security event log with a logon
type of 3.

Are logon type 3 only generated from inside the network or can they also be
generated from an outside connection (terminal services, Outlook Web Access,
VPN, etc).

Thanks in advance for your help.

 

[Guest]

Archived from groups: microsoft.public.win2000.security (More info?)

Terminal services for Windows 2000 is considered type 2 console logon. In Windows
2003 I think it gets it's own logon type of 10. Other than TS, type 3 logon would be
any logon attempt other than console/keyboard logon. Type 3 can originate from the
internet if there is no or an improperly configured firewall as users attempt to hack
ports such as 139 and 445 tcp. The link below is a good read on using the security
log and intrusion detection for windows. --- Steve

http://www.microsoft.com/technet/security/guidance/secmod144.mspx

http://www.microsoft.com/resources/documentation/WindowsServ/2003/datacenter/proddocs/en-us/Default.asp?url=/resources/documentation/windowsserv/2003/datacenter/proddocs/en-us/518.asp

"Bryan Bowers" <nobody@spam.com> wrote in message
news:umToB4$cEHA.3944@tk2msftngp13.phx.gbl...
> Howdy Everyone,
>
> I have seen a number of 529 errors in the security event log with a logon
> type of 3.
>
> Are logon type 3 only generated from inside the network or can they also be
> generated from an outside connection (terminal services, Outlook Web Access,
> VPN, etc).
>
> Thanks in advance for your help.
>
>