Windows 7 and Server 2003 security errors

Question

I have a domain with a 2003 DC and 2012 DC. There is one Windows 7 PC on the network that is not domain joined. On the 2003 DC the Security log has a lot of errors about Failed Login and the source IP is the non-domain joined PC. These same errors do
not appear on the 2012 DC.
I've looked at the PC and I'm quite certain there is no infection that is causing this. I ran netstat -ab on the PC and it showed 2 entries in the list that pertain to the server.
TCP 192.168.1.112:49405 server:epmap  ESTABLISHED [spoolsv.exe]
TCP 192.168.1.112:49547 server:epmap  ESTABLISHED [spoolsv.exe]
The 2003 DC does not have any printers installed on it as the 2012 DC is the print server. So I'm trying to figure out why the 2003 DC is getting all these failed logons and what the netstat entries on the PC have to do with it.
I don't think any harm is being one but there must be a lot of useless network traffic being generated by this as the errors on the DC are very numerous.
Jonathan

Answer 1

Hi SmallBizAdmin,
The details in Security log might be helpful for us to narrow down where the problem is, the best way is that refer to timeline in your error log and perform a network monitor on your client then find that why your Windows 7 computer keep trying access to
your Domain controller.
for the specific Windows Client, you could perform a clean boot and check if this issue still persists.
Since you mentioned that it showed 2 entries in the list that pertain to the server, and it’s for the spoolsv.exe. Check if spoolsv.exe is working properly on your client machine or you can reset it for good measure.
To reset your spool service:
In the right pane of the Services.msc locate and      right-click on Print Spooler and then select Stop.
After you have stopped this process, leave the Service      window open. Now open My Computer and navigate to the following folder.
                %windows%\system32\spool\PRINTERS 
Delete all the files in the Printers folder. After      deleting the files in this folder, go back to Services window, right-click      on Print Spooler, and then select start to re-enable the service.
Regards
Unfortunately a clean boot isn't possible. The PC is a ways away and this issue isn't critical enough to warrant a trip onsite.
I did restart the spool service on the PC and checked the PRINTERS folder but I didn't see any files there.
The failed audit events in the server's security log that are generated by this PC are 529 and 680 and they repeat over and over. There are 16 per minute, 8 529's and 8 680's. So you can how the Security log contains a lot more failed audit events
than normal. Since those events pertain to logon, I'm not certain how it ties to the spooler service on the PC. The PC is mapped directly by IP to two printers near it so it shouldn't need to authenticate with this 2003 DC at all. DHCP is handled
by the 2012 DC but it doesn't have any failed audit entries from the PC.
So I'm not sure if the netstat entries on the PC pertaining to spoolsve.exe have anything to do with the constant 529/680 failed audits on the server or not but so far that's all I can find on the PC that show any reference to the 2003 DC.
Jonathan