An Incorrect Authentication Package Name May Appear in Audit Event 529 (312827)


The information in this article applies to:

  • Microsoft Windows 2000 Server SP1
  • Microsoft Windows 2000 Server SP2
  • Microsoft Windows 2000 Advanced Server SP1
  • Microsoft Windows 2000 Advanced Server SP2
  • Microsoft Windows 2000 Professional SP1
  • Microsoft Windows 2000 Professional SP2
This article was previously published under Q312827

SYMPTOMS

You may see an incorrect authentication package name in audit event 529 (Logon Failure). This might occur if a custom authentication package has been installed and someone then tries to log on to the computer from the network by using a local account with an incorrect password. A custom authentication package name may be listed instead of NTLM in the audit logon failure event. The event log may mention the last installed authentication package name instead of the package that was actually used to perform authentication. For example:
Source: Security
Category: Logon/Logoff
Event ID: 529
Description:
Logon Failure:
Reason: Unknown user name or bad password
User Name: Administrator
Domain: Domain
Logon Type: 3
Logon Process: NtLmSsp
Authentication Package: CustomAP
Workstation Name: Clientcomputername

RESOLUTION

To resolve this problem, obtain the latest service pack for Windows 2000. For additional information, click the following article number to view the article in the Microsoft Knowledge Base:

260910 How to Obtain the Latest Windows 2000 Service Pack

The English version of this fix should have the following file attributes or later: 
   Date         Time   Version         Size      File name
   ----------------------------------------------------------
   09-Jan-2002  12:59  5.0.2195.4685    123,664  Adsldp.dll
   09-Jan-2002  12:59  5.0.2195.4762    130,320  Adsldpc.dll
   09-Jan-2002  12:59  5.0.2195.4016     62,736  Adsmsext.dll
   09-Jan-2002  12:59  5.0.2195.4797    356,112  Advapi32.dll
   09-Jan-2002  12:59  5.0.2195.4797     41,744  Basesrv.dll
   09-Jan-2002  12:59  5.0.2195.4571     82,704  Cmnquery.dll
   09-Jan-2002  12:59  5.0.2195.4141    133,904  Dnsapi.dll
   09-Jan-2002  12:59  5.0.2195.4379     91,408  Dnsrslvr.dll
   09-Jan-2002  12:59  5.0.2195.4534     41,744  Dsfolder.dll
   09-Jan-2002  12:59  5.0.2195.4534    156,944  Dsquery.dll
   09-Jan-2002  12:59  5.0.2195.4574    110,352  Dsuiext.dll
   10-Jan-2002  12:14  5.0.2195.4814    521,488  Instlsa5.dll
   09-Jan-2002  12:59  5.0.2195.4630    145,680  Kdcsvc.dll
   26-Nov-2001  18:33  5.0.2195.4680    199,440  Kerberos.dll
   09-Jan-2002  12:59  5.0.2195.4797    708,880  Kernel32.dll
   04-Sep-2001  10:32  5.0.2195.4276     71,024  Ksecdd.sys
   09-Jan-2002  12:50  5.0.2195.4814    503,568  Lsasrv.dll
   09-Jan-2002  12:50  5.0.2195.4814     33,552  Lsass.exe
   07-Dec-2001  18:05  5.0.2195.4745    107,280  Msv1_0.dll
   09-Jan-2002  12:50  5.0.2195.4814     28,944  Negotiat.dll
   09-Jan-2002  12:59  5.0.2195.4594    306,960  Netapi32.dll
   09-Jan-2002  12:59  5.0.2195.4686    359,184  Netlogon.dll
   09-Jan-2002  12:59  5.0.2195.4797    476,432  Ntdll.dll
   09-Jan-2002  12:59  5.0.2195.4746    916,240  Ntdsa.dll
   02-Jan-2002  23:15  5.0.2195.4805  1,665,856  Ntoskrnl.exe
   09-Jan-2002  12:59  5.0.2195.4748    388,368  Samsrv.dll
   09-Jan-2002  12:59  5.0.2195.4583    128,784  Scecli.dll
   09-Jan-2002  12:59  5.0.2195.4600    299,792  Scesrv.dll
   30-May-2001  02:03  5.0.2195.3649      3,584  Spmsg.dll
   09-Jan-2002  12:59  5.0.2195.4600     48,400  W32time.dll
   06-Nov-2001  13:43  5.0.2195.4600     56,592  W32tm.exe
   09-Jan-2002  12:59  5.0.2195.4769    125,712  Wldap32.dll

STATUS

Microsoft has confirmed that this is a problem in the Microsoft products that are listed at the beginning of this article. This problem was first corrected in Windows 2000 Service Pack 3.

MORE INFORMATION

For additional information about how to obtain a hotfix for Windows 2000 Datacenter Server, click the article number below to view the article in the Microsoft Knowledge Base:

265173 The Datacenter Program and Windows 2000 Datacenter Server Product

For additional information about how to install multiple hotfixes with only one reboot, click the article number below to view the article in the Microsoft Knowledge Base:

296861 Use QChain.exe to Install Multiple Hotfixes with One Reboot

For additional information about how to install Windows 2000 and Windows 2000 hotfixes at the same time, click the article number below to view the article in the Microsoft Knowledge Base:

249149 Installing Microsoft Windows 2000 and Windows 2000 Hotfixes

Modification Type:MinorLast Reviewed:9/26/2005
Keywords:kbHotfixServer kbQFE kbWin2kSP4fix kbbug kbfix kbSecurity kbWin2000PreSP3Fix kbWin2000sp3fix KB312827
©2004 Microsoft Corporation. All rights reserved.