Q

Why is our Win98 machine trying to access the NT servers late at night when no one is there?

I have a strange issue on my LAN involving a Windows 98 client and various NT Server domains. The security log on various domain controllers indicate that the Win98 machine (which is in its own workgroup with another win98 computer) periodically attempts to log on to different NT servers that do not belong in the workgroup (Event ID 529). It does so at times when there are no users at the workstation (I've checked and the office is locked without anyone in it when it happens).

Is there some service or application running on the Win98 client which would cause this to happen? The logon attempt always fails, and it appears the SYSTEM account may be involved. It is always listed as EVENT ID 529 and the cause for the log on failure is bad username or password.

Is there a way to get the Win98 machine to stop trying to access the NT servers?

I agree that you have a process running on the Windows 98 machine that is reaching out to the NT servers automatically. Do you have any mapped drives from the machine to the servers? They might be ghosted drives, meaning that the connection is dead but the virtual connection is still in the Registry.

From a command prompt, type NET USE and see if there are any entries. You may have a connection to IPC$, which is the secure channel used to pass credentials.

You might have left the workstation as a domain member. In the properties of the Client for Microsoft Networks, check to see if Log Onto Windows NT Domain is checked.

If all that comes up negative, you might need to run Network Monitor on one of the domain controllers and sniff for the traffic that comes from the client. The port number and type of request might give you a clue as to the service that's doing the request.

This was first published in September 2001

Dig deeper on Windows Data Storage Administration Tools

Pro+

Features

Enjoy the benefits of Pro+ membership, learn more and join.

Have a question for an expert?

Please add a title for your question

Get answers from a TechTarget expert on whatever's puzzling you.

You will be able to add details on the next page.

0 comments

Oldest 

Forgot Password?

No problem! Submit your e-mail address below. We'll send you an email containing your password.

Your password has been sent to:

-ADS BY GOOGLE

SearchServerVirtualization

SearchCloudComputing

SearchExchange

SearchSQLServer

SearchWinIT

SearchEnterpriseDesktop

SearchVirtualDesktop

Close