Petri.com forums Home Forums Start Page Forums Frequently Asked Questions FAQ Member List Members List
Go Back   Petri IT Knowledgebase Forums > Security > General Security
Petri.com is happy to award RicklesP the title of Most Valuable Member !!!
Register Calendar Calendar Search Petri IT Knowledgebase Forums Search Todays Posts Today's Posts Mark Forums Read
Notices

Arcserve Backup v15 Causing Event ID 529

Arcserve Backup v15 Causing Event ID 529

this thread has 1 replies and has been viewed 1892 times

Closed Thread
 
Thread Tools Search this Thread Display Modes
  #1  
Old 29th November 2010, 02:37
Ryzz Ryzz is offline
Casual
Casual
 
 Join Date: Mar 2009
  6 month star 12 month star
 Posts: 31
 Reputation: Ryzz is on a distinguished road (19)
Default Arcserve Backup v15 Causing Event ID 529

Hi All,

Hoping someone might of stumbled across this before. We recently just built a new fileserver for one of our regional sites, and we use Arcserve backup as the preferred backup software of choice *Shudder*.

Im having a weird problem, where it appears when we installed Arcserve somehow it has grabbed the username of my Admin account and constantly fills up the eventlogs with ID529 Failure audit. However the second part that is even more interesting is the failures are logged against server\admin_user not domain\admin_user.

Now obviously there is no local admin account as described above. Additionally I have rerun the CA Arcserve backup config tool and made sure that my username is not mentioned anywhere (we use service accounts for backups), also the Arcserve services are all running under the service account as well.

The logging seems to happen approx every hour, on the hour as well.

Here is an extract of one of the failed audits. The names have been changed to protect the guilty

Event Type: Failure Audit
Event Source: Security
Event Category: Logon/Logoff
Event ID: 529
Date: 28/11/2010
Time: 11:00:43 PM
User: NT AUTHORITY\SYSTEM
Computer: FS-001
Description:
Logon Failure:
Reason: Unknown user name or bad password
User Name: admin_user
Domain: FS-001
Logon Type: 2
Logon Process: Advapi
Authentication Package: Negotiate
Workstation Name: FS-001
Caller User Name: svc_backup
Caller Domain: ABC
Caller Logon ID: (0x0,0x16962)
Caller Process ID: 1736
Transited Services: -
Source Network Address: -
Source Port: -

Event Type: Failure Audit
Event Source: Security
Event Category: Account Logon
Event ID: 680
Date: 29/11/2010
Time: 12:00:42 AM
User: NT AUTHORITY\SYSTEM
Computer: FS-001
Description:
Logon attempt by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon account: admin_user
Source Workstation: FS-001
Error Code: 0xC0000064


So anyone that has any ideas, im all ears!!! Thx in advance
  #2  
Old 30th November 2010, 02:26
david.michel david.michel is offline
Casual
Casual
 
 Join Date: Aug 2010
  6 month star 12 month star
 Posts: 2
 Reputation: david.michel is on a distinguished road (10)
Default Re: Arcserve Backup v15 Causing Event ID 529

Check to see if the admin user was entered for the ARCserve System Account.

Select Server Admin and then Server Admin from the Menu bar and then ARCserve System Account.
Closed Thread


Thread Tools Search this Thread
Search this Thread:

Advanced Search
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off

Forum Jump

Similar Threads
Thread Thread Starter Forum Replies Last Post
event id 529' i think someone is trying to break into my server asi SBS 2000 / 2003 / 2008 / 2011 6 20th October 2009 12:03
Security Event 529 SK8Dogga SBS 2000 / 2003 / 2008 / 2011 9 16th November 2008 23:13
Arcserve Problems with Wins Backup (2003 DC) Retaliator Windows Server 2000 / 2003 / 2003 R2 0 15th August 2007 09:13
What is causing my PC to hang? JDMils Misc 6 18th April 2007 10:44
event id 529 and 680 failed audits roguecoolman Windows 2000 Pro, XP Pro 0 22nd July 2006 00:04


All times are GMT +3. The time now is 19:42.

Steel Blue 3.5.4 vBulletin Style ©2006 vBEnhanced
Powered by vBulletin® Version 3.8.4
Copyright ©2000 - 2014, Jelsoft Enterprises Ltd.
 

Valid XHTML 1.0!   Valid CSS!

Copyright 2005 Daniel Petri