server errors logon

[Guest Ian McCulloch]

Can someone explain what this performance counter is all about and what

values should I be concerned with?

 

Ian McCulloch

Sydney, NS

[Guest Bruce Sanderson]

Re: server errors logon

 

From Performance Monitor's Explain text for the Server, Error Logon

 

"The number of failed logon attempts to the server. Can indicate whether password guessing programs

are being used to crack the security on the server.".

 

"the server" in this case could be a workstation (e.g. Windows XP).

 

From what I can tell from experimenting, this reports the number of attempts to connect to a

resource provided by the "Server" service (e.g. a folder share) that failed (was rejected) becuase

of incorrect credentials send from the client. Logons failures via RDP don't seem to be counted by

this counter. This counter does not appear to related to the time interval displayed in Performance

Monitor's graph, but rather the number reported since the OS was restarted.

 

A few would be normal, but if you are seeing the value increase rapidly, this could indicate some

kind of automated "attack" attempt.

 

--

Bruce Sanderson

http://members.shaw.ca/bsanders/

It's perfectly useless to know the right answer to the wrong question.

 

 

"Ian McCulloch" <-remove-toocoldincanada@hotmail.com> wrote in message

news:4F570535-F861-4E21-AF27-3C8BE493E924@microsoft.com...

> Can someone explain what this performance counter is all about and what values should I be

> concerned with?

>

> Ian McCulloch

> Sydney, NS