Guest Ian McCulloch Posted July 30, 2008 Posted July 30, 2008 Can someone explain what this performance counter is all about and what values should I be concerned with? Ian McCulloch Sydney, NS
Guest Bruce Sanderson Posted August 1, 2008 Posted August 1, 2008 Re: server errors logon From Performance Monitor's Explain text for the Server, Error Logon "The number of failed logon attempts to the server. Can indicate whether password guessing programs are being used to crack the security on the server.". "the server" in this case could be a workstation (e.g. Windows XP). From what I can tell from experimenting, this reports the number of attempts to connect to a resource provided by the "Server" service (e.g. a folder share) that failed (was rejected) becuase of incorrect credentials send from the client. Logons failures via RDP don't seem to be counted by this counter. This counter does not appear to related to the time interval displayed in Performance Monitor's graph, but rather the number reported since the OS was restarted. A few would be normal, but if you are seeing the value increase rapidly, this could indicate some kind of automated "attack" attempt. -- Bruce Sanderson http://members.shaw.ca/bsanders/ It's perfectly useless to know the right answer to the wrong question. "Ian McCulloch" <-remove-toocoldincanada@hotmail.com> wrote in message news:4F570535-F861-4E21-AF27-3C8BE493E924@microsoft.com... > Can someone explain what this performance counter is all about and what values should I be > concerned with? > > Ian McCulloch > Sydney, NS
Recommended Posts