Slight difference in event log, need interpretation

I've noticed a slight difference in the event logs for
failed logins.

In the first entry the Domain is clearly not there but in
the next entry that occured right after the first, it is
there.

I see a good many of these in the logs. Any ideas? Does
this indicate a problem? We've had a few machines refuse
to login with any account until rebooted or until they've
had their computer account deleted and been rejoined to
the domain.

Type: Failure Audit Event ID: 529
User: NT AUTHORITY/SYSTEM

Description:

Logon Failure:
Reason: Unknown user name or bad password
User Name: USERNAME
Domain:
Logon Type: 3
Logon Process: NtLmSsp
Authentication Package: NTLM
Workstation Name: \\NAME
Caller User Name: -
Caller Domain: -
Caller Logon ID: -
Caller Process ID: -
Transited Services: -
Source Network Address: IPADDRESS
Source Port: 0



Type: Failure Audit Event ID: 529
User: NT AUTHORITY/SYSTEM

Description:

Logon Failure:
Reason: Unknown user name or bad password
User Name: USERNAME
Domain: DOMAIN
Logon Type: 3
Logon Process: NtLmSsp
Authentication Package: NTLM
Workstation Name: \\NAME
Caller User Name: -
Caller Domain: -
Caller Logon ID: -
Caller Process ID: -
Transited Services: -
Source Network Address: IPADDRESS
Source Port: 0

"Lee Haynes" wrote:
> I've noticed a slight difference in the event logs for
> failed logins.
>
> In the first entry the Domain is clearly not there but in
> the next entry that occured right after the first, it is
> there.
<!--SNiP-->

http://support.microsoft.com/default...NoWebContent=1


--
Roland

This information is distributed in the hope that it will be useful, but
without any warranty; without even the implied warranty of merchantability
or fitness for a particular purpose.