Event Message:

Logon Failure: Reason: Unknown user name or bad password User Name: user name Domain: name Logon Type: name Logon Process: parameter Authentication Package: parameter Workstation Name: computer name

Explanation:

This event record indicates an attempt to log on using an unknown user account or a valid user account but with an incorrect password. An unexpected increase in the number of these audits could represent an attempt by someone to find user accounts and passwords (such as a "dictionary" attack, in which a list of words is used by a program to attempt entry).

User Action:

The person with administrative rights for the computer should establish a threshold limit for attempted log ons. Attempts in excess of the limit should be investigated as a possible attempt to break into the computer.