Sophos security software: updates are failing and the Domain Controller reports Security Event 529

  • Article ID: 53528
  • Updated: 28 Feb 2011

Issue
Updates are failing and Security Event 529 is logged on the Domain Controller by local SophosSAU accounts.

Sophos product and version
Sophos Anti-Virus for Windows 2000+

Operating system
Microsoft Windows Server

What to do

  1. Please download and install the Microsoft service pack available from this Microsoft knowledgebase article:
    http://support.microsoft.com/?kbid=811082
  2. In the Windows Registry, add the AutoUpdate account as a Domain user:

HKLM\Software\Sophos\AutoUpdate\Service\

Download User=<DOMAIN>\<USER> with relevant password

Technical Information

The following event is logged twice in the Security log in the domain controller:

Event Type: Failure Audit
Event Source: Security
Event Category: Logon/Logoff
Event ID: 529
Date: date
Time: time
User: NT AUTHORITY\SYSTEM
Computer: domain controller computer name
Description:
Logon Failure:
Reason: Unknown user name or bad password
User Name: Sophos_ALC_Service
Domain: client computer name
Logon Type: 3
Logon Process: KSecDD
Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Workstation Name: client computer name

For more information, see the Microsoft Help and Support Center at http://support.microsoft.com.

 
If you need more information or guidance, then please contact technical support.

Rate this article

Very poor Excellent

Comments