Hello, I recently upgraded my Windows 2000 Server to Server 2003 Standard. Since then, my colo's SNMP alert utility has been mailing me almost every day with alerts, which I can find no cause of. The only interesting thing in the logs is a login failure, once every minute. I've been able to trace it down to SVCHOST.exe and that's about it. The account it's attempting to use is a local user account, not a system or network account. I tried looking through the services and finding if one was trying to login with the account, but no luck. Does anyone have a more detailed way to trace login failures? Logon Failure: Reason: Account locked out User Name: **_****_***** Domain: KMT002 Logon Type: 4 Logon Process: Advapi Authentication Package: Negotiate Workstation Name: ****** Caller User Name: ******$ Caller Domain: *** Caller Logon ID: (0x0,0x3E7) Caller Process ID: 816 Transited Services: - Source Network Address: - Source Port: - ------------ Logon attempt by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 Logon account: **_****_***** Source Workstation: ****** Error Code: 0xC0000234 ------------ I've *'ed out any usernames that pertain to our company, for anonymity's sake. Thanks in advance for any info.

http://www.auditmypc.com/process/ad... Google should always be your first stop... Imagine the power if you knew how to internet search

Google was my first stop, thanks for the advice. It's a matter of knowing more specifically what to search for. That's why I asked. But thank you for the answer. BTW, I think rather that this is what AdvApi is, in this case: http://www.processlibrary.com/direc... A standard Windows process for doing many security and registry calls. You'll notice on the Symantec site that Netdevil virus only affects Win2k and below. Anyone with a real answer?