Re: server errors logon
From Performance Monitor's Explain text for the Server, Error Logon
"The number of failed logon attempts to the server. Can indicate whether password guessing programs
are being used to crack the security on the server.".
"the server" in this case could be a workstation (e.g. Windows XP).
From what I can tell from experimenting, this reports the number of attempts to connect to a
resource provided by the "Server" service (e.g. a folder share) that failed (was rejected) becuase
of incorrect credentials send from the client. Logons failures via RDP don't seem to be counted by
this counter. This counter does not appear to related to the time interval displayed in Performance
Monitor's graph, but rather the number reported since the OS was restarted.
A few would be normal, but if you are seeing the value increase rapidly, this could indicate some
kind of automated "attack" attempt.
--
Bruce Sanderson
http://members.shaw.ca/bsanders/
It's perfectly useless to know the right answer to the wrong question.
"Ian McCulloch" <-remove-toocoldincanada@hotmail.com> wrote in message
news:4F570535-F861-4E21-AF27-3C8BE493E924@microsoft.com...
> Can someone explain what this performance counter is all about and what values should I be
> concerned with?
>
> Ian McCulloch
> Sydney, NS