Without going into to much detail. I have found that the SBS 2003 Server Manager daily reports have recently began showing excessive amounts of failed logon attempts daily. Below is todays log Typically it is some foreign domain, or an IP address (like below) Yesterday I went throught the Windows Security logs and found no failed attempts I cleared the security log and then changed the Default Domain Policy Auditing to Failed and Success. (failed is disabled by default in the GPO) Below is todays log - 2300 attempts and none of them show up in the security logs Where are these failed attempts being recorded from? Obviously not a GPO? Why are the Security logs showing one thing and the Server Report showing another. Is there any other ways of getting more info as to why this is happening. Is this someone attempting to get in via RWW - if so how is this logged I have seen this on other SBS machines so i realize this is not a "problem" Critical Errors in Security Log Source Event ID Last Occurrence Total Occurrences Security 529 12/1/2008 4:38 AM 2,320 * Logon Failure: Reason: Unknown user name or bad password User Name: administrator Domain: XXX.XXX.XXX.XXX - (Public mail IPaddress was entered here) Logon Type: 3 Logon Process: NtLmSsp Authentication Package: NTLM Workstation Name: DFGHFDGHFDGH Caller User Name: - Caller Domain: - Caller Logon ID: - Caller Process ID: - Transited Services: - Source Network Address: 121.14.213.91 Source Port: 3421

Dear customer: Since your issue is related to SBS 2003, our forum focuses on Exchange relative problem, this isnt a good place for troubleshoot your issue. Please post the issue into the following newsgroup, maybe you can get more help at there. http://www.microsoft.com/communities/newsgroups/en-us/default.aspx?dg=microsoft.public.smallbusinessmanager&cat=en_US_92f14d55-0e47-4175-8446-1898abd8fb86&lang=en&cr=US Thanks for your cooperation and understanding. Rock Wang - MSFTRock Wang MSFT