ON 20080222@9:22:15 AM at page:
http://techref.massmind.org/techref/os/win/xps.htm#39500.3904398148
James Newton[JMN-EFP-786] Says
/techref/os/win/2003sbs.htm
Windows Server 2003 Small Business



ON 20080222@9:22:44 AM at page:
http://techref.massmind.org/techref/os/win/xps.htm#
James Newton[JMN-EFP-786] edited the page. Difference:
http://techref.massmind.org/techref/diff.asp?url=H:\techref\os\win\xps.htm&version=1



ON 20080222@9:24:28 AM at page:
http://techref.massmind.org/techref/os/win/2003sbs.htm#39500.3919791667
James Newton[JMN-EFP-786] Says
/techref/os/win/w32time.htm
W32Time: Windows Time Service



ON 20080222@9:26:07 AM at page:
http://techref.massmind.org/techref/os/win/2003sbs.htm#
James Newton[JMN-EFP-786] edited the page. Difference:
http://techref.massmind.org/techref/diff.asp?url=H:\techref\os\win\2003sbs.htm&version=1



ON 20080222@9:26:19 AM at page:
http://techref.massmind.org/techref/os/win/2003sbs.htm#
James Newton[JMN-EFP-786] edited the page. Difference:
http://techref.massmind.org/techref/diff.asp?url=H:\techref\os\win\2003sbs.htm&version=2



ON 20080222@9:27:30 AM at page:
http://techref.massmind.org/techref/os/win/w32time.htm#39500.3940972222
James Newton[JMN-EFP-786] See also:
http://blogs.mcbsys.com/mark/post/Hotfix-Lets-W32time-Sync-with-Very-High-Precision-NTP-Servers.aspx
Setting up internet time sources on a 2003 server



ON 20080222@9:29:58 AM at page:
http://techref.massmind.org/techref/os/win/w32time.htm#39500.3957986111
James Newton[JMN-EFP-786] See also:
http://support.microsoft.com/kb/940742 
The Windows Time service in Windows Server 2003 does not synchronize time with a time server if the precision value of the NTP response is less than -30 (ultra precise). A hotfix is available.<BR>




ON 20080222@9:33:36 AM at page:
http://techref.massmind.org/techref/os/win/w32time.htm#
James Newton[JMN-EFP-786] edited the page. Difference:
http://techref.massmind.org/techref/diff.asp?url=H:\techref\os\win\w32time.htm&version=2



ON 20080222@9:38:50 AM at page:
http://techref.massmind.org/techref/os/win/2003sbs.htm#39500.4019675926
James Newton[JMN-EFP-786] See also:
http://support.microsoft.com/kb/810489
Turning off the stupid Exchange MTA warnings: Event ID: 2000 "Verify that the Microsoft Exchange MTA service has started. Consecutive ma-open calls are failing with error 3051." MTA is only used when the server is a transport bridgehead to Exchange Server 5.5 servers, or running the GroupWise, Notes or other Exchange Development Kit (EDK) connector, such as a third-party Fax connector.



ON 20080222@9:55:33 AM at page:
http://techref.massmind.org/techref/os/win/w32time.htm#
James Newton[JMN-EFP-786] edited the page. Difference:
http://techref.massmind.org/techref/diff.asp?url=H:\techref\os\win\w32time.htm&version=3



ON 20080222@10:04:48 AM at page:
http://techref.massmind.org/techref/os/win/w32time.htm#
James Newton[JMN-EFP-786] edited the page. Difference:
http://techref.massmind.org/techref/diff.asp?url=H:\techref\os\win\w32time.htm&version=4



ON 20080222@10:13:05 AM at page:
http://techref.massmind.org/techref/os/win/w32time.htm#
James Newton[JMN-EFP-786] edited the page. Difference:
http://techref.massmind.org/techref/diff.asp?url=H:\techref\os\win\w32time.htm&version=5



ON 20080222@10:18:12 AM at page:
http://techref.massmind.org/techref/os/win/w32time.htm#
James Newton[JMN-EFP-786] edited the page. Difference:
http://techref.massmind.org/techref/diff.asp?url=H:\techref\os\win\w32time.htm&version=6



ON 20080222@10:26:31 AM at page:
http://techref.massmind.org/techref/os/win/w32time.htm#
James Newton[JMN-EFP-786] edited the page. Difference:
http://techref.massmind.org/techref/diff.asp?url=H:\techref\os\win\w32time.htm&version=7



ON 20080222@10:28:06 AM at page:
http://techref.massmind.org/techref/os/win/w32time.htm#
James Newton[JMN-EFP-786] edited the page. Difference:
http://techref.massmind.org/techref/diff.asp?url=H:\techref\os\win\w32time.htm&version=8



ON 20080222@10:36:55 AM at page:
http://techref.massmind.org/techref/os/win/w32time.htm#
James Newton[JMN-EFP-786] edited the page. Difference:
http://techref.massmind.org/techref/diff.asp?url=H:\techref\os\win\w32time.htm&version=9



ON 20080225@8:13:14 AM at page:
http://techref.massmind.org/techref/os/win/w32time.htm#
James Newton[JMN-EFP-786] edited the page. Difference:
http://techref.massmind.org/techref/diff.asp?url=H:\techref\os\win\w32time.htm&version=10



ON 20080225@8:15:31 AM at page:
http://techref.massmind.org/techref/os/win/w32time.htm#
James Newton[JMN-EFP-786] edited the page. Difference:
http://techref.massmind.org/techref/diff.asp?url=H:\techref\os\win\w32time.htm&version=11



ON 20080225@8:15:55 AM at page:
http://techref.massmind.org/techref/os/win/w32time.htm#
James Newton[JMN-EFP-786] edited the page. Difference:
http://techref.massmind.org/techref/diff.asp?url=H:\techref\os\win\w32time.htm&version=12



ON 20080225@8:16:09 AM at page:
http://techref.massmind.org/techref/os/win/w32time.htm#
James Newton[JMN-EFP-786] edited the page. Difference:
http://techref.massmind.org/techref/diff.asp?url=H:\techref\os\win\w32time.htm&version=13



ON 20080225@8:37:22 AM at page:
http://techref.massmind.org/techref/os/win/2003sbs.htm#39503.3592708333
James Newton[JMN-EFP-786] Says
/techref/os/win/logonfailure.htm
Windows Logon Failure Investigation



ON 20080225@8:39:07 AM at page:
http://techref.massmind.org/techref/os/win/logonfailure.htm#39503.3604976852
James Newton[JMN-EFP-786] Says

The following Event ID's indicate that a logon failed:
<UL>
<LI>Event ID 529 : Unknown user name or bad password 
<LI>Event ID 530 : Logon time restriction violation 
<LI>Event ID 531 : Account disabled 
<LI>Event ID 532 : Account expired 
<LI>Event ID 533 : Workstation restriction - not allowed to logon at this computer 
<LI>Event ID 534 : Inadequate rights - as in user account attempting console login to server 
<LI>Event ID 535 : Password expired 
<LI>Event ID 536 : NetLogon service down 
<LI>Event ID 537 : unexpected error - the who knows ??? factor 
<LI>Event ID 539 : Logon Failure: Account locked out 
<LI>Event ID 627 : NT AUTHORITY\ANONYMOUS is trying to change a password 
<LI>Event ID 644 : User account Locked out
</UL>
You should watch for events 529, 539 and 644.

Event ID 529 entries can have various "Logon Types":<UL>
<LI>2 – Interactive - A user logged on to this computer at the console. 
<LI>3 - Network - A user or computer logged on to this computer from the network. 
<LI>4 - Batch - Batch logon type is used by batch servers, where processes might run on behalf of a user without the user's direct intervention. 
<LI>5 - Service - A service was started by the Service Control Manager. 
<LI>7 – Unlock - This workstation was unlocked. 
<LI>8 - NetworkCleartext - A user logged on to a network and the user password was passed to the authentication package in its unhashed (plain text) form. It is possible that the unhashed password was passed across the network, for example, when IIS performed basic authentication. 
<LI>9 – NewCredentials -A caller (process, thread, or program) cloned its current token and specified new credentials for outbound connections. The new logon session has the same local identity, but it uses different credentials for other network connections. 
<LI>10 – RemoteInteractive - A user logged on to this computer remotely using Terminal Services or a Remote Desktop connection. 
<LI>11 – CachedInteractive - A user logged on to this computer with network credentials that were stored locally on the computer. The domain controller was not contacted to verify the credentials.
</UL>



ON 20080225@8:57:28 AM at page:
http://techref.massmind.org/techref/os/win/logonfailure.htm#39503.3732407407
James Newton[JMN-EFP-786] Says

Event ID 529 will also have a process ID that can be used to find the program that passed on the logon attempt. Use the Task Manager (ctrl+alt+delete then select Task Manager, or if logged in remotely, Start / Windows Security) to lookup the name of the process, from the "Processes" tab, select View / Select Columns and check "PID (Process Identifier)" then click ok.
<P>
With Event ID 529, Logon Type 3, and a PID that turns out to be inetinfo.exe, the error was probably caused by an attempt to log in to the server via the remote web workspace, Outlook web access, or (apparently) an attempt to log in via SMTP and relay email<A HREF="http://forums.microsoft.com/ForeFront/ShowPost.aspx?PostID=2836214&SiteID=41">^</A>. The web access log may have more information including the IP address of the attacker.



ON 20080225@9:11:37 AM at page:
http://techref.massmind.org/techref/os/win/logonfailure.htm#
James Newton[JMN-EFP-786] edited the page. Difference:
http://techref.massmind.org/techref/diff.asp?url=H:\techref\os\win\logonfailure.htm&version=2