HELP! The master browser has received a server announcement....?????

[rocketlauncher]

Hello Everyone!

Can anyone be kind enough to explain to me, what does these messages mean and why do they come up??

1) "The master browser has received a server announcement from the computer (x) that believes that it is the master browser for the domain on transport NetBT_EI09x1. The master browser is stopped or an election is being forced".

NOTE: WHERE (x) is one Computer in the network. and I receive it very constantly from any computer in the network.

2) "The server was unable to logon the Windows NT account due to the following error logon failure:unknown username or bad password. The data is the error code".

NOTE: is a user name. And this message comes up at non-working hours or days.

3) "Changing machine account password for account Exchange$ failed with the following error. The RPC server is unavailable".

NOTE: Now this one is at nonworking days.

I would apprecciate if any one could give me an explanation of each message and what could cause it, and how can i solve these issues.

Thanks for your time.

Desperate Rocketlauncher.

 

[jaeddy]

I am assuming (with all the risks thereof) that we are talking about errors recorded on a Domain Controller. Could be a number of things, from an organized attack to a simple matter of services or tasks launching using an expired password.

The browser announcements are fairly common when you have numerous systems configured to take part in maintaining server lists. The Browser service is what provides the list of systems in Network Neighborhood. Generally speaking the Domain PDC is the Domain Master Browser, while other servers or workstations act as Master and backup browsers on the various sub-nets.

If a computer is shut down while it is a master browser an election is forced to choose a new master browser (I will NOT go in to how this process works). When the computer is turned on again it still thinks that it is the master browser and another election is forced.

The logon failures could be a number of things. If users have scheduled tasks to run on off hours and used the latest Scheduled Tasks applet to do it, they are likely trying to run those tasks under their account. If they changed their password on the domain without updating it in the Scheduled Task the task will not start and wll generate a logon error. The same goes for NT services. Some services may be configured to use an account other than the local system account. If that account password is changed, it must be changed in the Startup options of the service or the service will be unable to start.

It is also possible that someone is trying to hack in to your network, either remotely or by sitting down at an unattended workstation. The logon error information ought to include the name of the workstation where the user failed to log on. If you are getting these errors from the same machines go look over their event logs, scheduled tasks, services, etc. If it is a valid user name you'll need to ask that person if they have tasks scheduled, etc.

The attempt to change the machine account password for Exchange$ is disturbing, but if it is happening regularly it again could be innocuous. I am not an Exchange expert by any stretch. Might want to mosey on over to the Exchange forum and post the question there if you get no answers here.

 

[paulwood]

Is there any 'out of hours' access externally through leased line, DSL, dialup, etc. where someone could access the network?