Security Event Logs

[Oak]

#154594

Hi All

Im wondering if anyone can help me to solve issues im having, let me explain my environment.

We were recently taken over by a multinational and our single forest single domain AD environment was one way trusted with the mothership, now they have migrated AD objects ie users and computer accounts to the mothership domain and now we have joined all workstations to the mother ship domain so all users now loginto the mothership domain not the legacy “our” domain, now users still access email and sharepoint from the legacy via the trust but its not that smooth as there are numerous account lock outs and speed issues since the change over.

The latest issue i have been asked by the admins at the mothership is to investigate why so many “Failure Audits” are occuring on the DC’s of the motherships servers originaling from “MY-Exchange” on the legacy domain. I presume its because its a one way trust and the requests are being somehow blocked by the trust would i be correct any one got any ideas, below is what i see in my exchange event logs

Event Type: Failure Audit
Event Source: Security
Event Category: Account Logon
Event ID: 680
Date: 12/05/2011
Time: 16:00:24
User: NT AUTHORITYSYSTEM
Computer: MY-EXCHANGE
Description:
Logon attempt by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon account: jdoe
Source Workstation: WKST000113
Error Code: 0xC0000064

below is what the mothership get on their event logs, they say they have got 850 of these events in the last week alone?

Event Type: Failure Audit
Event Source: Security
Event Category: Account Logon
Event ID: 680
Date: 5/11/2011
Time: 11:09:42 AM
User: NT AUTHORITYSYSTEM
Computer: MOTHERSHIPDC001
Description:
Logon attempt by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon account: Administrator
Source Workstation: MY-EXCHANGE
Error Code: 0xC000006A

Any help would be greatly appreciated.
Oak

[Author]

Posts