[Ryzz]

Hi All,

Hoping someone might of stumbled across this before. We recently just built a new fileserver for one of our regional sites, and we use Arcserve backup as the preferred backup software of choice *Shudder*.

Im having a weird problem, where it appears when we installed Arcserve somehow it has grabbed the username of my Admin account and constantly fills up the eventlogs with ID529 Failure audit. However the second part that is even more interesting is the failures are logged against server\admin_user not domain\admin_user.

Now obviously there is no local admin account as described above. Additionally I have rerun the CA Arcserve backup config tool and made sure that my username is not mentioned anywhere (we use service accounts for backups), also the Arcserve services are all running under the service account as well.

The logging seems to happen approx every hour, on the hour as well.

Here is an extract of one of the failed audits. The names have been changed to protect the guilty

Event Type: Failure Audit
Event Source: Security
Event Category: Logon/Logoff
Event ID: 529
Date: 28/11/2010
Time: 11:00:43 PM
User: NT AUTHORITY\SYSTEM
Computer: FS-001
Description:
Logon Failure:
Reason: Unknown user name or bad password
User Name: admin_user
Domain: FS-001
Logon Type: 2
Logon Process: Advapi
Authentication Package: Negotiate
Workstation Name: FS-001
Caller User Name: svc_backup
Caller Domain: ABC
Caller Logon ID: (0x0,0x16962)
Caller Process ID: 1736
Transited Services: -
Source Network Address: -
Source Port: -

Event Type: Failure Audit
Event Source: Security
Event Category: Account Logon
Event ID: 680
Date: 29/11/2010
Time: 12:00:42 AM
User: NT AUTHORITY\SYSTEM
Computer: FS-001
Description:
Logon attempt by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon account: admin_user
Source Workstation: FS-001
Error Code: 0xC0000064


So anyone that has any ideas, im all ears!!! Thx in advance

[david.michel]

Check to see if the admin user was entered for the ARCserve System Account.

Select Server Admin and then Server Admin from the Menu bar and then ARCserve System Account.