Unknown user name or bad password containd no data

how can find out account , or client event refering to? have service account got locked up, noticed that the event below generated every few seconds...

event type: failure audit
event source: security
event category: logon/logoff
event id: 529
date:  01/04/2009
time:  23:48:03
user:  nt authority\system
computer: samantha
description:
logon failure:
  reason:  unknown user name or bad password
  user name: 
  domain:  
  logon type: 3
  logon process: kerberos
  authentication package: kerberos
  workstation name: -
  caller user name: -
  caller domain: -
  caller logon id: -
  caller process id: -
  transited services: -
  source network address: -
  source port: -

for more information, see , support center @ http://go.microsoft.com/fwlink/events.asp.

hi,

 

based on event log, notice user name blank. normally, event should contain user information. looks dc received authentication request not decode authentication package information. caused authentication fail , lead account being locked out. possible cause client machines infected virus. please perform virus scan , let me know result.

 

if want find out client workstation authentication packet sent from, can capture network packet further research.

Windows Server  >  Directory Services