Security Event Logs

Viewing 1 post (of 1 total)
  • Author
    Posts
  • Avatar
    Oak
    Member
    #154594

    Hi All

    Im wondering if anyone can help me to solve issues im having, let me explain my environment.

    We were recently taken over by a multinational and our single forest single domain AD environment was one way trusted with the mothership, now they have migrated AD objects ie users and computer accounts to the mothership domain and now we have joined all workstations to the mother ship domain so all users now loginto the mothership domain not the legacy “our” domain, now users still access email and sharepoint from the legacy via the trust but its not that smooth as there are numerous account lock outs and speed issues since the change over.

    The latest issue i have been asked by the admins at the mothership is to investigate why so many “Failure Audits” are occuring on the DC’s of the motherships servers originaling from “MY-Exchange” on the legacy domain. I presume its because its a one way trust and the requests are being somehow blocked by the trust would i be correct any one got any ideas, below is what i see in my exchange event logs

    Event Type: Failure Audit
    Event Source: Security
    Event Category: Account Logon
    Event ID: 680
    Date: 12/05/2011
    Time: 16:00:24
    User: NT AUTHORITYSYSTEM
    Computer: MY-EXCHANGE
    Description:
    Logon attempt by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
    Logon account: jdoe
    Source Workstation: WKST000113
    Error Code: 0xC0000064

    below is what the mothership get on their event logs, they say they have got 850 of these events in the last week alone?

    Event Type: Failure Audit
    Event Source: Security
    Event Category: Account Logon
    Event ID: 680
    Date: 5/11/2011
    Time: 11:09:42 AM
    User: NT AUTHORITYSYSTEM
    Computer: MOTHERSHIPDC001
    Description:
    Logon attempt by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
    Logon account: Administrator
    Source Workstation: MY-EXCHANGE
    Error Code: 0xC000006A

    Any help would be greatly appreciated.
    Oak

Viewing 1 post (of 1 total)

You must be logged in to reply to this topic.