Microsoft KB Archive/312827

= An Incorrect Authentication Package Name May Appear in Audit Event 529 =

Article ID: 312827

Article Last Modified on 1/31/2007

-

APPLIES TO


 * Microsoft Windows 2000 Service Pack 1
 * Microsoft Windows 2000 Service Pack 2
 * Microsoft Windows 2000 Advanced Server
 * Microsoft Windows 2000 Advanced Server
 * Microsoft Windows 2000 Service Pack 1
 * Microsoft Windows 2000 Service Pack 2

-



This article was previously published under Q312827



SYMPTOMS
You may see an incorrect authentication package name in audit event 529 (Logon Failure). This might occur if a custom authentication package has been installed and someone then tries to log on to the computer from the network by using a local account with an incorrect password. A custom authentication package name may be listed instead of NTLM in the audit logon failure event. The event log may mention the last installed authentication package name instead of the package that was actually used to perform authentication. For example:

Source: Security

Category: Logon/Logoff

Event ID: 529

Description:

Logon Failure:

Reason: Unknown user name or bad password

User Name: Administrator

Domain:

Logon Type: 3

Logon Process: NtLmSsp

Authentication Package: CustomAP

Workstation Name:



RESOLUTION
To resolve this problem, obtain the latest service pack for Windows 2000. For additional information, click the following article number to view the article in the Microsoft Knowledge Base:

260910 How to Obtain the Latest Windows 2000 Service Pack

The English version of this fix should have the following file attributes or later:   Date         Time   Version         Size      File name --  09-Jan-2002  12:59  5.0.2195.4685    123,664  Adsldp.dll 09-Jan-2002 12:59  5.0.2195.4762    130,320  Adsldpc.dll 09-Jan-2002 12:59  5.0.2195.4016     62,736  Adsmsext.dll 09-Jan-2002 12:59  5.0.2195.4797    356,112  Advapi32.dll 09-Jan-2002 12:59  5.0.2195.4797     41,744  Basesrv.dll 09-Jan-2002 12:59  5.0.2195.4571     82,704  Cmnquery.dll 09-Jan-2002 12:59  5.0.2195.4141    133,904  Dnsapi.dll 09-Jan-2002 12:59  5.0.2195.4379     91,408  Dnsrslvr.dll 09-Jan-2002 12:59  5.0.2195.4534     41,744  Dsfolder.dll 09-Jan-2002 12:59  5.0.2195.4534    156,944  Dsquery.dll 09-Jan-2002 12:59  5.0.2195.4574    110,352  Dsuiext.dll 10-Jan-2002 12:14  5.0.2195.4814    521,488  Instlsa5.dll 09-Jan-2002 12:59  5.0.2195.4630    145,680  Kdcsvc.dll 26-Nov-2001 18:33  5.0.2195.4680    199,440  Kerberos.dll 09-Jan-2002 12:59  5.0.2195.4797    708,880  Kernel32.dll 04-Sep-2001 10:32  5.0.2195.4276     71,024  Ksecdd.sys 09-Jan-2002 12:50  5.0.2195.4814    503,568  Lsasrv.dll 09-Jan-2002 12:50  5.0.2195.4814     33,552  Lsass.exe 07-Dec-2001 18:05  5.0.2195.4745    107,280  Msv1_0.dll 09-Jan-2002 12:50  5.0.2195.4814     28,944  Negotiat.dll 09-Jan-2002 12:59  5.0.2195.4594    306,960  Netapi32.dll 09-Jan-2002 12:59  5.0.2195.4686    359,184  Netlogon.dll 09-Jan-2002 12:59  5.0.2195.4797    476,432  Ntdll.dll 09-Jan-2002 12:59  5.0.2195.4746    916,240  Ntdsa.dll 02-Jan-2002 23:15  5.0.2195.4805  1,665,856  Ntoskrnl.exe 09-Jan-2002 12:59  5.0.2195.4748    388,368  Samsrv.dll 09-Jan-2002 12:59  5.0.2195.4583    128,784  Scecli.dll 09-Jan-2002 12:59  5.0.2195.4600    299,792  Scesrv.dll 30-May-2001 02:03  5.0.2195.3649      3,584  Spmsg.dll 09-Jan-2002 12:59  5.0.2195.4600     48,400  W32time.dll 06-Nov-2001 13:43  5.0.2195.4600     56,592  W32tm.exe 09-Jan-2002 12:59  5.0.2195.4769    125,712  Wldap32.dll



STATUS
Microsoft has confirmed that this is a problem in the Microsoft products that are listed at the beginning of this article. This problem was first corrected in Windows 2000 Service Pack 3.



MORE INFORMATION
For additional information about how to obtain a hotfix for Windows 2000 Datacenter Server, click the article number below to view the article in the Microsoft Knowledge Base:

265173 The Datacenter Program and Windows 2000 Datacenter Server Product

For additional information about how to install multiple hotfixes with only one reboot, click the article number below to view the article in the Microsoft Knowledge Base:

296861 Use QChain.exe to Install Multiple Hotfixes with One Reboot

For additional information about how to install Windows 2000 and Windows 2000 hotfixes at the same time, click the article number below to view the article in the Microsoft Knowledge Base:

249149 Installing Microsoft Windows 2000 and Windows 2000 Hotfixes

Additional query words:

Keywords: kbbug kbfix kbwin2000presp3fix kbqfe kbwin2000sp3fix kbsecurity kbwin2ksp4fix kbhotfixserver KB312827

-

[mailto:TECHNET@MICROSOFT.COM Send feedback to Microsoft]

© Microsoft Corporation. All rights reserved.