Hi

For the life of me i cant figure out how to block certain 529 windows security failure errors for specific users. In the documentation it states to use the "USER" attribute but this only works if the user is mentioned in the user field of the error log. If it mentions "NT AUTHORITY\SYSTEM", is it not possible to restrict it based on the user?

Example:

security: failure - 2009/04/13 17:40:55 - Security (529) - NT AUTHORITY\SYSTEM "Logon Failure: Reason: Unknown user name or bad password User Name: John1234 Domain: CONTOSO Logon Type: 3 Logon Process: NtLmSsp Authentication Package: NTLM Workstation Name: \\123.45.67.89 Caller User Name: - Caller Domain: - Caller Logon ID: - Caller Process ID: - Transited

The username is "NT AUTHORITY\SYSTEM" but the actualy user is "John1234"..

Anybody have and ideas? I dont want to block "NT AUTHORITY\SYSTEM".