Why is our Win98 machine trying to access the NT servers late at night when no one is there?

I have a strange issue on my LAN involving a Windows 98 client and various NT Server domains. The security log on various domain controllers indicate that the Win98 machine (which is in its own workgroup with another win98 computer) periodically attempts to log on to different NT servers that do not belong in the workgroup (Event ID 529). It does so at times when there are no users at the workstation (I've checked and the office is locked without anyone in it when it happens).

Is there some service or application running on the Win98 client which would cause this to happen? The logon attempt always fails, and it appears the SYSTEM account may be involved. It is always listed as EVENT ID 529 and the cause for the log on failure is bad username or password.

Is there a way to get the Win98 machine to stop trying to access the NT servers?

    Requires Free Membership to View

    Login

I agree that you have a process running on the Windows 98 machine that is reaching out to the NT servers automatically. Do you have any mapped drives from the machine to the servers? They might be ghosted drives, meaning that the connection is dead but the virtual connection is still in the Registry.

From a command prompt, type NET USE and see if there are any entries. You may have a connection to IPC$, which is the secure channel used to pass credentials.

You might have left the workstation as a domain member. In the properties of the Client for Microsoft Networks, check to see if Log Onto Windows NT Domain is checked.

If all that comes up negative, you might need to run Network Monitor on one of the domain controllers and sniff for the traffic that comes from the client. The port number and type of request might give you a clue as to the service that's doing the request.

This was first published in September 2001

Join the conversationComment

Share
Comments

    Results

    Contribute to the conversation

    All fields are required. Comments will appear at the bottom of the article.
    Back to top