Errors Logon Alerts in Performance Monitor (176616)
The information in this article applies to:
- Microsoft Windows NT Workstation 3.51
- Microsoft Windows NT Workstation 4.0
- Microsoft Windows NT Server 3.51
- Microsoft Windows NT Server 4.0
This article was previously published under Q176616 SYMPTOMS
In Performance Monitor, if you have set up an alert for Errors Logon to
catch failed logon attempts, you see an alert generated every five seconds.
CAUSE
The number of failed logon attempts since the server was last restarted has
exceeded the alert parameter that was set when the alert was configured.
MORE INFORMATION
The counter for Errors Logon is not reset to zero whenever the alert is
issued. This can lead Administrators to believe that a password hacking
program is being used, or that a rogue service is on the network. If the
alert parameter is set to five, after Windows NT records six bad logon
attempts, it will log an alert every five seconds (the default interval)
until the computer is restarted.
| Modification Type: | Major | Last Reviewed: | 8/9/2001 |
|---|
| Keywords: | kbprb KB176616 |
|---|
|