Errors Logon Alerts in Performance Monitor

 Last reviewed: November 18, 1997
Article ID: Q176616
The information in this article applies to:
  • Microsoft Windows NT Workstation versions 3.51 and 4.0
  • Microsoft Windows NT Server versions 3.51 and 4.0

SYMPTOMS

In Performance Monitor, if you have set up an alert for Errors Logon to catch failed logon attempts, you see an alert generated every five seconds.

CAUSE

The number of failed logon attempts since the server was last restarted has exceeded the alert parameter that was set when the alert was configured.

MORE INFORMATION

The counter for Errors Logon is not reset to zero whenever the alert is issued. This can lead Administrators to believe that a password hacking program is being used, or that a rogue service is on the network. If the alert parameter is set to five, after Windows NT records six bad logon attempts, it will log an alert every five seconds (the default interval) until the computer is restarted.

Additional reference words: audit perfmon
Keywords : ntdomain NTSrvWkst
Version : WinNT:3.51,4.0
Platform : winnt
Hardware : x86
Issue type : kbprb

THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. MICROSOFT DISCLAIMS ALL WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. IN NO EVENT SHALL MICROSOFT CORPORATION OR ITS SUPPLIERS BE LIABLE FOR ANY DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT, INCIDENTAL, CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF MICROSOFT CORPORATION OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. SOME STATES DO NOT ALLOW THE EXCLUSION OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES SO THE FOREGOING LIMITATION MAY NOT APPLY.

Last reviewed: November 18, 1997
© 1998 Microsoft Corporation. All rights reserved. Terms of Use.