We are seeing a lot of log entries on our workgroup servers that look like the following. The BE server is a memeber of a domain, and the BE services run under domain admin credentials. The login id's that fail are the ones used by the BackupExec services on the BE server and the guest account. The BackupExec services on the system being backed up and the BackupExec jobs are configured to use local admin accounts to access these systems. Why does it try to connect using accountnames other than the ones configured in the job?
Host : <servername>
Application : Security
Time Generated : Wed Jul 04 22:04:22 2007
Criticality : Failure
EventID : 529
Occurance : 1
Message : Logon Failure:
Reason: Unknown user name or bad password
User Name: <username>
Logon Type: 3
Logon Process: NtLmSsp
Authentication Package: NTLM
Workstation Name: <BackupExec Server>
Source Network Address: xxx.xxx.xxx.xxx (BE server IP)
Source Port: 0
I'm having this same issue. The backup job for server-A contains the correct credentials and completes normally. But ever day the Backup Exec Server tries to logon to server-A using the wrong credentials and is logged in the Security Event Log. It seems like Backup Exec is checking every day to see if it still can communicate with server-A but uses the wrong credentials.
As this thread was originally created against Backup Exec 11D back in 2007 I assume that you might be running a more recent version of BE.
The newer versions of BE have an option that is enabled by default to "Discover Data to Backup Up" which might be trying to connect to servers across your nwetwork and then working fine aganst the servers that are members of the domain, but perhaps causing these entries if you have workgrouped systems with different credentials. If this is the cause then the security warning shoud always be at the same time of day and the time will be close to that is configured against the "Discover Data to Backup" settings. All affected servers wil also show the times as being close to each other AND the times won't be close to significant steps against any running Backup Jobs (Job Start, Media Mount, changing between resources being backed up, Job End etc)