I'm not sure if this is the right forum but I am having excessive Failed
Login's reported in NRM. Normally this is a few hundred in an hour but the
highest is 49821!!

Now I would expect that we would have a few failed logins with Student using
incorrect credentials especially as we have our Student Proxy servers (Squid
on Linux) doing LDAP authentication to this server also.

What we are seeing is some user accounts with failed logins - fair enough
but then we get occasions where we see the following:

Time: Wednesday, 9-28-2005 1:31 pm
Address: IP xxx.xxx.xxx.xxx
User: Unknown (ID=1)

Time: Wednesday, 9-28-2005 1:31 pm
Address: IP xxx.xxx.xxx.xxx
User: Unknown (ID=2)

Time: Wednesday, 9-28-2005 1:31 pm
Address: IP xxx.xxx.xxx.xxx
User: Unknown (ID=1)

The IP address is the IP of the server itself. This used to be the IPX
address of the server until I removed IPX from the server at which point it
was replaced by the IP address.

Does anyone have any suggestions as to what might be causeing this? Any
pointers as to what Unknown (ID=1) means?

Thanks
Mark