Windows Security Log Event ID 529

Operating Systems Windows Server 2000
Windows 2003 and XP
Type Failure
Corresponding events
in Windows 2008
and Vista

529: Logon Failure - Unknown user name or bad password

On this page

Event 529 is logged on the workstation or server where the user failed to log on.

The Logon Type will enable you to determine if the user was present at this computer or elsewhere on the network.  The following Logon Types are possible:

Logon Type
 Interactive (logon at keyboard and screen of system) Windows 2000 records Terminal Services logon as this type rather than Type 10.
Network (i.e. connection to shared folder on this computer from elsewhere on network or IIS logon - Never logged by 528 on W2k and forward. See event 540)
Batch (i.e. scheduled task)
Service (Service startup)
Unlock (i.e. unnattended workstation with password protected screen saver)
NetworkCleartext (Logon with credentials sent in the clear text. Most often indicates a logon to IIS with "basic authentication") See this article for more information.
RemoteInteractive (Terminal Services, Remote Desktop or Remote Assistance)
CachedInteractive (logon with cached domain credentials such as when logging on to a laptop when away from the network)

Free Security Log Resources by Randy

Description Fields in 529

  • User Name:
  • Domain:
  • Logon Type:
  • Logon Process:
  • Authentication Package: 
  • Workstation Name:

The following fields are added with Windows Server 2003 

  • Caller User Name:
  • Caller Domain:
  • Caller Logon ID:
  • Caller Process ID:
  • Transited Services:
  • Source Network Address:
  • Source Port:

Supercharger Free Edition

Centrally manage WEC subscriptions.



Examples of 529

Logon Failure
Reason: Unknown user name or bad password
User Name: %1
Domain: %2
Logon Type: %3
Logon Process: %4
Authentication Package: %5
Workstation Name: %6

Windows Server 2003 adds these fields:

Caller User Name:-
Caller Domain:-
Caller Logon ID:-
Caller Process ID:-
Transited Services:-
Source Network Address:
Source Port:0

Top 10 Windows Security Events to Monitor

Free Tool for Windows Event Collection


Additional Resources