stop process and user

[Guest Bryce]

Hi,

not sure if this is for here. my event log fills up with this:

Event Type: Success Audit

Event Source: Security

Event Category: Logon/Logoff

Event ID: 528

Date: 12/29/2008

Time: 10:27:18 AM

User: dom\Roger

Computer: DC0102

Description:

Successful Logon:

User Name: roger

Domain: dom

Logon ID: (0x0,0x2CA37FE6)

Logon Type: 2

Logon Process: Advapi

Authentication Package: Negotiate

Workstation Name: DC0102

Logon GUID: {518809c1-23da-cdd2-9d6f-6f311daa75f5}

Caller User Name: DC0102$

Caller Domain: dom

Caller Logon ID: (0x0,0x3E7)

Caller Process ID: 1540

Transited Services: -

Source Network Address: -

Source Port: -

 

 

For more information, see Help and Support Center at

http://go.microsoft.com/fwlink/events.asp.

 

i need to know how to track down this process:

"Logon Process: Advapi " and stop it.

 

we had an arcserve backup database on a sql box that was moved to a

different box.

the error started them.

when we create the database onthe old box, the error on the sql box goes away.

the sql error is this:

Event Type: Failure Audit

Event Source: MSSQLSERVER

Event Category: (4)

Event ID: 18456

Date: 12/29/2008

Time: 10:27:18 AM

User: dom\Roger

Computer: DB003

Description:

Login failed for user

 

probably way to much useless details but where can i start.

Thanks.