Hello bugtraq subscribers,
Below is a description of three security problems
with Windows XP Professional, which we think are
bugs - not features. We are actually writing a book
about Windows XP security and need to clarify these concerns.
Please express you opinions and let us know if you find these
problems important to Windows XP security.
System affected: Windows XP Professional in a workgroup.
I. Problem with account locking due to fast user switching
Fast user switching is a new Windows XP feature,
which allows simultaneous loging on of more than one user.
It is based on Terminal Services technology and runs unique
user sessions that enable each user's data to be entirely separated.
Fast User Switching is enabled by default on a stand-alone
or workgroup-connected computer. It is not available in domains.
While extensively using this new feature, we found that it locks
out accounts on our machine.
Please try this on your Windows XP computers:
1. Set the account lockout threshold to 3 attempts.
2. Create 10 user accounts with user level privileges (User1 -
User10).
3. Logon using User1 account.
4. Using fast user switching, logon using User2 account.
5. Use fast switching to change from User1 to User2 3 times.
6. Attempt to logon using User3 account.
At this point, every account on the machine would be locked out
(except Administrator account of course).
Security Log would now show logon failure (ID529) and account locked
(ID539)
entries. Please see attached TXT file with event log entries.
We have also found, that there is no need to switch between _two_
users.
Even switching between _one_ user (logging on and logging off using
fast
user switching) results in all acounts being locked out.
We notified Microsoft on December the 5th, 2001 and received the
following
reply from Microsoft Security Response Center:
From: Microsoft Security Response Center [mailto:secure@microsoft.com]
Sent: Wednesday, December 12, 2001 10:54 PM
To: Tomasz Polus
Cc: Microsoft Security Response Center
Subject: RE: Fast User Switching blocks user accounts [cb]
[...] "Fast User Switching is a feature that's designed primarily for
home users.
One thing that Fast User Switching does is to check local accounts for
blank
passwords to determine if a prompt should be provided for a particular
user or not.
Users who have elected to maintain blank passwords are not shown the
prompt
for their account when they switch accounts. Because of this, if
account lockouts
are enabled in conjunction with Fast User Switching, it is possible
for this
feature to inadvertently lockout accounts.
If you want to enable the account lockout feature, it's recommended
that you
not use the Fast User Switching feature.
I hope this is helpful in clarifying what you are seeing.
Please let us know if you have any questions or concerns." [...]
I would like to point out they didn't write that only accounts with
blank passwords
are locked out - which is actually right. For all of our test accounts
passwords has_been_set.
This problem does not affect accounts with blank passwords.
As you can see, Microsoft admitted this to be a problem and
recommended
not to use fast user switching in conjunction with Account Lockout.
We see this as a significant limitation on the new feature,
and/or a forced downgrading of security settings.
II. Problem with reset password disk
Windows XP introduced a new feature - "Password Reset Disk", which can
be used
to recover user account and personalized computer settings if a user
forgets
his password.
The problem is that in certain conditions (Minimum password age <> 0)
user may not be able to reset his password using above mentioned disk
and the only solution is the reset password feature available to the
Administrator.
First, make sure the "Minimum password age" policy is set to a value
other than 0.
Now, supposing the user forgets his password before it's age expires,
he will not be able to reset it with the disk until the password
expires.
What's more, changing password by an Admnistrator using MMC or control
panel
(in other words - GUI) leads to user data loss (i.e. EFS files)
because of
private key loss.
The only solution seems to be "net user" command issued by an
administrator.
III. Remote Desktop sends recently used username in plaintext
This problem was first detected by Szymon Nowak - we made the tests
and drew
the final conclusions.
Remote Desktop client remembers account name which has been used
recently
to establish RD session with another machine.
When sniffing the network, Szymon found that RD client has send login
to the
other computer in plain text. We clarified that what was actually sent
is not
a user account name on the destination machine, but username which has
been used
recently to logon with RD client.
However, assuming that the logon is made to the same computer as
recently,
RD client sends in clear text user account name present on the
destination
computer. In some cases, this can pose a big security risk. For
example,
if RD client is used by users connecting to a terminal server,
the attacker can sniff all the TS user accounts.
We're very interested in your opinions about all these problems.
Please try this at your machines and let us now if these are common,
so we could find versions affected.
Regards,
--
Tomasz Polus
tpolus@bsi.net.pl
BSI Sp. z o.o. <http://www.bsi.net.pl>
2001-12-11 09:27:30 Security Success Audit Logon/Logoff 528 S-1-5-21-1645522239-706699826-1060284298-500 TEST "Successful Logon:
User Name: Administrator
Domain: TEST
Logon ID: (0x0,0x5DEF6)
Logon Type: 2
Logon Process: Advapi
Authentication Package: Negotiate
Workstation Name: TEST
Logon GUID: {00000000-0000-0000-0000-000000000000}"
2001-12-11 09:27:30 Security Success Audit Account Logon 680 NT AUTHORITY\SYSTEM TEST Logon attempt by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon account: administrator
Source Workstation: TEST
Error Code: 0x0
2001-12-11 09:27:00 Security Success Audit Logon/Logoff 538 S-1-5-21-1645522239-706699826-1060284298-1015 TEST "User Logoff:
User Name: user1
Domain: TEST
Logon ID: (0x0,0x5D135)
Logon Type: 2
"
2001-12-11 09:27:00 Security Success Audit Logon/Logoff 528 S-1-5-21-1645522239-706699826-1060284298-1015 TEST "Successful Logon:
User Name: user1
Domain: TEST
Logon ID: (0x0,0x5D135)
Logon Type: 2
Logon Process: Advapi
Authentication Package: Negotiate
Workstation Name: TEST
Logon GUID: {00000000-0000-0000-0000-000000000000}"
2001-12-11 09:27:00 Security Success Audit Account Logon 680 NT AUTHORITY\SYSTEM TEST Logon attempt by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon account: user1
Source Workstation: TEST
Error Code: 0x0
2001-12-11 09:26:43 Security Failure Audit Logon/Logoff 539 NT AUTHORITY\SYSTEM TEST "Logon Failure:
Reason: Account locked out
User Name: user3
Domain: TEST
Logon Type: 2
Logon Process: Advapi
Authentication Package: Negotiate
Workstation Name: TEST"
2001-12-11 09:26:43 Security Failure Audit Account Logon 680 NT AUTHORITY\SYSTEM TEST Logon attempt by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon account: user3
Source Workstation: TEST
Error Code: 0xC0000234
2001-12-11 09:26:37 Security Failure Audit Logon/Logoff 539 NT AUTHORITY\SYSTEM TEST "Logon Failure:
Reason: Account locked out
User Name: user2
Domain: TEST
Logon Type: 2
Logon Process: Advapi
Authentication Package: Negotiate
Workstation Name: TEST"
2001-12-11 09:26:37 Security Failure Audit Account Logon 680 NT AUTHORITY\SYSTEM TEST Logon attempt by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon account: user2
Source Workstation: TEST
Error Code: 0xC0000234
2001-12-11 09:26:32 Security Failure Audit Logon/Logoff 539 NT AUTHORITY\SYSTEM TEST "Logon Failure:
Reason: Account locked out
User Name: user10
Domain: TEST
Logon Type: 2
Logon Process: Advapi
Authentication Package: Negotiate
Workstation Name: TEST"
2001-12-11 09:26:32 Security Failure Audit Account Logon 680 NT AUTHORITY\SYSTEM TEST Logon attempt by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon account: user10
Source Workstation: TEST
Error Code: 0xC0000234
2001-12-11 09:26:25 Security Failure Audit Logon/Logoff 539 NT AUTHORITY\SYSTEM TEST "Logon Failure:
Reason: Account locked out
User Name: user10
Domain: TEST
Logon Type: 2
Logon Process: Advapi
Authentication Package: Negotiate
Workstation Name: TEST"
2001-12-11 09:26:25 Security Failure Audit Account Logon 680 NT AUTHORITY\SYSTEM TEST Logon attempt by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon account: user10
Source Workstation: TEST
Error Code: 0xC0000234
2001-12-11 09:26:11 Security Failure Audit Logon/Logoff 539 NT AUTHORITY\SYSTEM TEST "Logon Failure:
Reason: Account locked out
User Name: user9
Domain: TEST
Logon Type: 2
Logon Process: Advapi
Authentication Package: Negotiate
Workstation Name: TEST"
2001-12-11 09:26:11 Security Failure Audit Account Logon 680 NT AUTHORITY\SYSTEM TEST Logon attempt by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon account: user9
Source Workstation: TEST
Error Code: 0xC0000234
2001-12-11 09:26:11 Security Failure Audit Logon/Logoff 539 NT AUTHORITY\SYSTEM TEST "Logon Failure:
Reason: Account locked out
User Name: user8
Domain: TEST
Logon Type: 2
Logon Process: Advapi
Authentication Package: Negotiate
Workstation Name: TEST"
2001-12-11 09:26:11 Security Failure Audit Account Logon 680 NT AUTHORITY\SYSTEM TEST Logon attempt by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon account: user8
Source Workstation: TEST
Error Code: 0xC0000234
2001-12-11 09:26:11 Security Failure Audit Logon/Logoff 539 NT AUTHORITY\SYSTEM TEST "Logon Failure:
Reason: Account locked out
User Name: user7
Domain: TEST
Logon Type: 2
Logon Process: Advapi
Authentication Package: Negotiate
Workstation Name: TEST"
2001-12-11 09:26:11 Security Failure Audit Account Logon 680 NT AUTHORITY\SYSTEM TEST Logon attempt by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon account: user7
Source Workstation: TEST
Error Code: 0xC0000234
2001-12-11 09:26:11 Security Failure Audit Logon/Logoff 539 NT AUTHORITY\SYSTEM TEST "Logon Failure:
Reason: Account locked out
User Name: user6
Domain: TEST
Logon Type: 2
Logon Process: Advapi
Authentication Package: Negotiate
Workstation Name: TEST"
2001-12-11 09:26:11 Security Failure Audit Account Logon 680 NT AUTHORITY\SYSTEM TEST Logon attempt by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon account: user6
Source Workstation: TEST
Error Code: 0xC0000234
2001-12-11 09:26:11 Security Failure Audit Logon/Logoff 539 NT AUTHORITY\SYSTEM TEST "Logon Failure:
Reason: Account locked out
User Name: user5
Domain: TEST
Logon Type: 2
Logon Process: Advapi
Authentication Package: Negotiate
Workstation Name: TEST"
2001-12-11 09:26:11 Security Failure Audit Account Logon 680 NT AUTHORITY\SYSTEM TEST Logon attempt by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon account: user5
Source Workstation: TEST
Error Code: 0xC0000234
2001-12-11 09:26:11 Security Failure Audit Logon/Logoff 539 NT AUTHORITY\SYSTEM TEST "Logon Failure:
Reason: Account locked out
User Name: user4
Domain: TEST
Logon Type: 2
Logon Process: Advapi
Authentication Package: Negotiate
Workstation Name: TEST"
2001-12-11 09:26:11 Security Failure Audit Account Logon 680 NT AUTHORITY\SYSTEM TEST Logon attempt by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon account: user4
Source Workstation: TEST
Error Code: 0xC0000234
2001-12-11 09:26:11 Security Failure Audit Logon/Logoff 539 NT AUTHORITY\SYSTEM TEST "Logon Failure:
Reason: Account locked out
User Name: user3
Domain: TEST
Logon Type: 2
Logon Process: Advapi
Authentication Package: Negotiate
Workstation Name: TEST"
2001-12-11 09:26:11 Security Failure Audit Account Logon 680 NT AUTHORITY\SYSTEM TEST Logon attempt by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon account: user3
Source Workstation: TEST
Error Code: 0xC0000234
2001-12-11 09:26:11 Security Failure Audit Logon/Logoff 539 NT AUTHORITY\SYSTEM TEST "Logon Failure:
Reason: Account locked out
User Name: user2
Domain: TEST
Logon Type: 2
Logon Process: Advapi
Authentication Package: Negotiate
Workstation Name: TEST"
2001-12-11 09:26:11 Security Failure Audit Account Logon 680 NT AUTHORITY\SYSTEM TEST Logon attempt by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon account: user2
Source Workstation: TEST
Error Code: 0xC0000234
2001-12-11 09:26:11 Security Failure Audit Logon/Logoff 539 NT AUTHORITY\SYSTEM TEST "Logon Failure:
Reason: Account locked out
User Name: user10
Domain: TEST
Logon Type: 2
Logon Process: Advapi
Authentication Package: Negotiate
Workstation Name: TEST"
2001-12-11 09:26:11 Security Failure Audit Account Logon 680 NT AUTHORITY\SYSTEM TEST Logon attempt by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon account: user10
Source Workstation: TEST
Error Code: 0xC0000234
2001-12-11 09:26:10 Security Failure Audit Logon/Logoff 529 NT AUTHORITY\SYSTEM TEST "Logon Failure:
Reason: Unknown user name or bad password
User Name: user1
Domain: TEST
Logon Type: 2
Logon Process: Advapi
Authentication Package: Negotiate
Workstation Name: TEST"
2001-12-11 09:26:10 Security Failure Audit Account Logon 680 NT AUTHORITY\SYSTEM TEST Logon attempt by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon account: user1
Source Workstation: TEST
Error Code: 0xC000006A
2001-12-11 09:26:10 Security Failure Audit Logon/Logoff 539 NT AUTHORITY\SYSTEM TEST "Logon Failure:
Reason: Account locked out
User Name: tpolus
Domain: TEST
Logon Type: 2
Logon Process: Advapi
Authentication Package: Negotiate
Workstation Name: TEST"
2001-12-11 09:26:10 Security Failure Audit Account Logon 680 NT AUTHORITY\SYSTEM TEST Logon attempt by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon account: tpolus
Source Workstation: TEST
Error Code: 0xC0000234
2001-12-11 09:26:10 Security Failure Audit Logon/Logoff 539 NT AUTHORITY\SYSTEM TEST "Logon Failure:
Reason: Account locked out
User Name: testowy
Domain: TEST
Logon Type: 2
Logon Process: Advapi
Authentication Package: Negotiate
Workstation Name: TEST"
2001-12-11 09:26:10 Security Failure Audit Account Logon 680 NT AUTHORITY\SYSTEM TEST Logon attempt by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon account: testowy
Source Workstation: TEST
Error Code: 0xC0000234
2001-12-11 09:26:10 Security Failure Audit Logon/Logoff 539 NT AUTHORITY\SYSTEM TEST "Logon Failure:
Reason: Account locked out
User Name: stan
Domain: TEST
Logon Type: 2
Logon Process: Advapi
Authentication Package: Negotiate
Workstation Name: TEST"
2001-12-11 09:26:10 Security Failure Audit Account Logon 680 NT AUTHORITY\SYSTEM TEST Logon attempt by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon account: stan
Source Workstation: TEST
Error Code: 0xC0000234
2001-12-11 09:26:10 Security Failure Audit Logon/Logoff 529 NT AUTHORITY\SYSTEM TEST "Logon Failure:
Reason: Unknown user name or bad password
User Name: pawel
Domain: TEST
Logon Type: 2
Logon Process: Advapi
Authentication Package: Negotiate
Workstation Name: TEST"
2001-12-11 09:26:10 Security Failure Audit Account Logon 680 NT AUTHORITY\SYSTEM TEST Logon attempt by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon account: pawel
Source Workstation: TEST
Error Code: 0xC000006A
2001-12-11 09:26:10 Security Failure Audit Logon/Logoff 539 NT AUTHORITY\SYSTEM TEST "Logon Failure:
Reason: Account locked out
User Name: Manuela
Domain: TEST
Logon Type: 2
Logon Process: Advapi
Authentication Package: Negotiate
Workstation Name: TEST"
2001-12-11 09:26:10 Security Failure Audit Account Logon 680 NT AUTHORITY\SYSTEM TEST Logon attempt by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon account: Manuela
Source Workstation: TEST
Error Code: 0xC0000234
2001-12-11 09:26:09 Security Failure Audit Logon/Logoff 539 NT AUTHORITY\SYSTEM TEST "Logon Failure:
Reason: Account locked out
User Name: jakisuser
Domain: TEST
Logon Type: 2
Logon Process: Advapi
Authentication Package: Negotiate
Workstation Name: TEST"
2001-12-11 09:26:09 Security Failure Audit Account Logon 680 NT AUTHORITY\SYSTEM TEST Logon attempt by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon account: jakisuser
Source Workstation: TEST
Error Code: 0xC0000234
2001-12-11 09:26:09 Security Failure Audit Logon/Logoff 539 NT AUTHORITY\SYSTEM TEST "Logon Failure:
Reason: Account locked out
User Name: Jacek
Domain: TEST
Logon Type: 2
Logon Process: Advapi
Authentication Package: Negotiate
Workstation Name: TEST"
2001-12-11 09:26:09 Security Failure Audit Account Logon 680 NT AUTHORITY\SYSTEM TEST Logon attempt by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon account: Jacek
Source Workstation: TEST
Error Code: 0xC0000234
2001-12-11 09:26:09 Security Failure Audit Logon/Logoff 539 NT AUTHORITY\SYSTEM TEST "Logon Failure:
Reason: Account locked out
User Name: Ania
Domain: TEST
Logon Type: 2
Logon Process: Advapi
Authentication Package: Negotiate
Workstation Name: TEST"
2001-12-11 09:26:09 Security Failure Audit Account Logon 680 NT AUTHORITY\SYSTEM TEST Logon attempt by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon account: Ania
Source Workstation: TEST
Error Code: 0xC0000234
2001-12-11 09:25:55 Security Failure Audit Object Access 560 S-1-5-21-1645522239-706699826-1060284298-1015 TEST "Object Open:
Object Server: SC Manager
Object Type: SERVICE OBJECT
Object Name: FastUserSwitchingCompatibility
Handle ID: -
Operation ID: {0,212955}
Process ID: 700
Image File Name: E:\WINDOWS\system32\services.exe
Primary User Name: TEST$
Primary Domain: HARDXP
Primary Logon ID: (0x0,0x3E7)
Client User Name: user1
Client Domain: TEST
Client Logon ID: (0x0,0x33AE5)
Accesses: Query status of service
Start the service
Stop the service
Privileges: -
Restricted Sid Count: 0
"
2001-12-11 09:25:54 Security Success Audit Logon/Logoff 528 S-1-5-21-1645522239-706699826-1060284298-1015 TEST "Successful Logon:
User Name: user1
Domain: TEST
Logon ID: (0x0,0x33AE5)
Logon Type: 2
Logon Process: User32
Authentication Package: Negotiate
Workstation Name: TEST
Logon GUID: {00000000-0000-0000-0000-000000000000}"
2001-12-11 09:25:54 Security Success Audit Account Logon 680 NT AUTHORITY\SYSTEM TEST Logon attempt by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon account: user1
Source Workstation: TEST
Error Code: 0x0
2001-12-11 09:25:43 Security Failure Audit Logon/Logoff 539 NT AUTHORITY\SYSTEM TEST "Logon Failure:
Reason: Account locked out
User Name: user9
Domain: TEST
Logon Type: 2
Logon Process: Advapi
Authentication Package: Negotiate
Workstation Name: TEST"
2001-12-11 09:25:43 Security Failure Audit Account Logon 680 NT AUTHORITY\SYSTEM TEST Logon attempt by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon account: user9
Source Workstation: TEST
Error Code: 0xC0000234
2001-12-11 09:25:43 Security Failure Audit Logon/Logoff 539 NT AUTHORITY\SYSTEM TEST "Logon Failure:
Reason: Account locked out
User Name: user8
Domain: TEST
Logon Type: 2
Logon Process: Advapi
Authentication Package: Negotiate
Workstation Name: TEST"
2001-12-11 09:25:43 Security Failure Audit Account Logon 680 NT AUTHORITY\SYSTEM TEST Logon attempt by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon account: user8
Source Workstation: TEST
Error Code: 0xC0000234
2001-12-11 09:25:43 Security Failure Audit Logon/Logoff 539 NT AUTHORITY\SYSTEM TEST "Logon Failure:
Reason: Account locked out
User Name: user7
Domain: TEST
Logon Type: 2
Logon Process: Advapi
Authentication Package: Negotiate
Workstation Name: TEST"
2001-12-11 09:25:43 Security Failure Audit Account Logon 680 NT AUTHORITY\SYSTEM TEST Logon attempt by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon account: user7
Source Workstation: TEST
Error Code: 0xC0000234
2001-12-11 09:25:43 Security Failure Audit Logon/Logoff 539 NT AUTHORITY\SYSTEM TEST "Logon Failure:
Reason: Account locked out
User Name: user6
Domain: TEST
Logon Type: 2
Logon Process: Advapi
Authentication Package: Negotiate
Workstation Name: TEST"
2001-12-11 09:25:43 Security Failure Audit Account Logon 680 NT AUTHORITY\SYSTEM TEST Logon attempt by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon account: user6
Source Workstation: TEST
Error Code: 0xC0000234
2001-12-11 09:25:43 Security Failure Audit Logon/Logoff 539 NT AUTHORITY\SYSTEM TEST "Logon Failure:
Reason: Account locked out
User Name: user5
Domain: TEST
Logon Type: 2
Logon Process: Advapi
Authentication Package: Negotiate
Workstation Name: TEST"
2001-12-11 09:25:43 Security Failure Audit Account Logon 680 NT AUTHORITY\SYSTEM TEST Logon attempt by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon account: user5
Source Workstation: TEST
Error Code: 0xC0000234
2001-12-11 09:25:43 Security Failure Audit Logon/Logoff 539 NT AUTHORITY\SYSTEM TEST "Logon Failure:
Reason: Account locked out
User Name: user4
Domain: TEST
Logon Type: 2
Logon Process: Advapi
Authentication Package: Negotiate
Workstation Name: TEST"
2001-12-11 09:25:43 Security Failure Audit Account Logon 680 NT AUTHORITY\SYSTEM TEST Logon attempt by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon account: user4
Source Workstation: TEST
Error Code: 0xC0000234
2001-12-11 09:25:43 Security Failure Audit Logon/Logoff 539 NT AUTHORITY\SYSTEM TEST "Logon Failure:
Reason: Account locked out
User Name: user3
Domain: TEST
Logon Type: 2
Logon Process: Advapi
Authentication Package: Negotiate
Workstation Name: TEST"
2001-12-11 09:25:43 Security Failure Audit Account Logon 680 NT AUTHORITY\SYSTEM TEST Logon attempt by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon account: user3
Source Workstation: TEST
Error Code: 0xC0000234
2001-12-11 09:25:43 Security Failure Audit Logon/Logoff 539 NT AUTHORITY\SYSTEM TEST "Logon Failure:
Reason: Account locked out
User Name: user2
Domain: TEST
Logon Type: 2
Logon Process: Advapi
Authentication Package: Negotiate
Workstation Name: TEST"
2001-12-11 09:25:43 Security Failure Audit Account Logon 680 NT AUTHORITY\SYSTEM TEST Logon attempt by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon account: user2
Source Workstation: TEST
Error Code: 0xC0000234
2001-12-11 09:25:43 Security Failure Audit Logon/Logoff 539 NT AUTHORITY\SYSTEM TEST "Logon Failure:
Reason: Account locked out
User Name: user10
Domain: TEST
Logon Type: 2
Logon Process: Advapi
Authentication Package: Negotiate
Workstation Name: TEST"
2001-12-11 09:25:43 Security Failure Audit Account Logon 680 NT AUTHORITY\SYSTEM TEST Logon attempt by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon account: user10
Source Workstation: TEST
Error Code: 0xC0000234
2001-12-11 09:25:42 Security Failure Audit Logon/Logoff 529 NT AUTHORITY\SYSTEM TEST "Logon Failure:
Reason: Unknown user name or bad password
User Name: user1
Domain: TEST
Logon Type: 2
Logon Process: Advapi
Authentication Package: Negotiate
Workstation Name: TEST"
2001-12-11 09:25:42 Security Failure Audit Account Logon 680 NT AUTHORITY\SYSTEM TEST Logon attempt by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon account: user1
Source Workstation: TEST
Error Code: 0xC000006A
2001-12-11 09:25:42 Security Failure Audit Logon/Logoff 539 NT AUTHORITY\SYSTEM TEST "Logon Failure:
Reason: Account locked out
User Name: tpolus
Domain: TEST
Logon Type: 2
Logon Process: Advapi
Authentication Package: Negotiate
Workstation Name: TEST"
2001-12-11 09:25:42 Security Failure Audit Account Logon 680 NT AUTHORITY\SYSTEM TEST Logon attempt by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon account: tpolus
Source Workstation: TEST
Error Code: 0xC0000234
2001-12-11 09:25:42 Security Failure Audit Logon/Logoff 539 NT AUTHORITY\SYSTEM TEST "Logon Failure:
Reason: Account locked out
User Name: testowy
Domain: TEST
Logon Type: 2
Logon Process: Advapi
Authentication Package: Negotiate
Workstation Name: TEST"
2001-12-11 09:25:42 Security Failure Audit Account Logon 680 NT AUTHORITY\SYSTEM TEST Logon attempt by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon account: testowy
Source Workstation: TEST
Error Code: 0xC0000234
2001-12-11 09:25:42 Security Failure Audit Logon/Logoff 539 NT AUTHORITY\SYSTEM TEST "Logon Failure:
Reason: Account locked out
User Name: stan
Domain: TEST
Logon Type: 2
Logon Process: Advapi
Authentication Package: Negotiate
Workstation Name: TEST"
2001-12-11 09:25:42 Security Failure Audit Account Logon 680 NT AUTHORITY\SYSTEM TEST Logon attempt by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon account: stan
Source Workstation: TEST
Error Code: 0xC0000234
2001-12-11 09:25:42 Security Failure Audit Logon/Logoff 529 NT AUTHORITY\SYSTEM TEST "Logon Failure:
Reason: Unknown user name or bad password
User Name: pawel
Domain: TEST
Logon Type: 2
Logon Process: Advapi
Authentication Package: Negotiate
Workstation Name: TEST"
2001-12-11 09:25:42 Security Failure Audit Account Logon 680 NT AUTHORITY\SYSTEM TEST Logon attempt by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon account: pawel
Source Workstation: TEST
Error Code: 0xC000006A
2001-12-11 09:25:41 Security Failure Audit Logon/Logoff 539 NT AUTHORITY\SYSTEM TEST "Logon Failure:
Reason: Account locked out
User Name: Manuela
Domain: TEST
Logon Type: 2
Logon Process: Advapi
Authentication Package: Negotiate
Workstation Name: TEST"
2001-12-11 09:25:41 Security Failure Audit Account Logon 680 NT AUTHORITY\SYSTEM TEST Logon attempt by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon account: Manuela
Source Workstation: TEST
Error Code: 0xC0000234
2001-12-11 09:25:41 Security Failure Audit Logon/Logoff 539 NT AUTHORITY\SYSTEM TEST "Logon Failure:
Reason: Account locked out
User Name: jakisuser
Domain: TEST
Logon Type: 2
Logon Process: Advapi
Authentication Package: Negotiate
Workstation Name: TEST"
2001-12-11 09:25:41 Security Failure Audit Account Logon 680 NT AUTHORITY\SYSTEM TEST Logon attempt by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon account: jakisuser
Source Workstation: TEST
Error Code: 0xC0000234
2001-12-11 09:25:41 Security Failure Audit Logon/Logoff 539 NT AUTHORITY\SYSTEM TEST "Logon Failure:
Reason: Account locked out
User Name: Jacek
Domain: TEST
Logon Type: 2
Logon Process: Advapi
Authentication Package: Negotiate
Workstation Name: TEST"
2001-12-11 09:25:41 Security Failure Audit Account Logon 680 NT AUTHORITY\SYSTEM TEST Logon attempt by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon account: Jacek
Source Workstation: TEST
Error Code: 0xC0000234
2001-12-11 09:25:41 Security Failure Audit Logon/Logoff 539 NT AUTHORITY\SYSTEM TEST "Logon Failure:
Reason: Account locked out
User Name: Ania
Domain: TEST
Logon Type: 2
Logon Process: Advapi
Authentication Package: Negotiate
Workstation Name: TEST"
2001-12-11 09:25:41 Security Failure Audit Account Logon 680 NT AUTHORITY\SYSTEM TEST Logon attempt by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon account: Ania
Source Workstation: TEST
Error Code: 0xC0000234
2001-12-11 09:25:34 Security Success Audit Logon/Logoff 551 S-1-5-21-1645522239-706699826-1060284298-1004 TEST "User initiated logoff:
User Name: pawel
Domain: TEST
Logon ID: (0x0,0x1671f)
"
2001-12-11 09:25:27 Security Success Audit System Event 517 NT AUTHORITY\SYSTEM TEST "The audit log was cleared
Primary User Name: SYSTEM
Primary Domain: ZARZĄDZANIE NT
Primary Logon ID: (0x0,0x3E7)
Client User Name: pawel
Client Domain: TEST
Client Logon ID: (0x0,0x1671F)
"
