Announcement

Collapse
No announcement yet.

event id 529 and 680 failed audits

Collapse
X
  • Filter
  • Time
  • Show
Clear All
new posts

  • event id 529 and 680 failed audits

    i'm not sure if this it he right forum, but please move it to the right one.

    I have 2 failed aduits in the security log on a pc.

    event id 529, source: security
    category: logon/logoff

    and

    Eventid: 680, source: security, category: account logon

    the machine that received this event log is a windows xp sp2 machine, on a windows 2000 domain.

    the info on the 529 is as such:

    Logon Failure:
    Reason: Unknown user name or bad password
    User Name: AdminAdmin
    Domain: 800-597907B3EC6
    Logon Type: 3
    Logon Process: NtLmSsp
    Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
    Workstation Name: 800-597907B3EC6

    For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.


    the 680 info is:

    Logon attempt by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
    Logon account: AdminAdmin
    Source Workstation: 800-597907B3EC6
    Error Code: 0xC0000064




    ---------------:

    now as far as i understand for 529, logon type 3 is a network connection type login. It obviously failed because user: adminadmin does not exist.

    however I do know where this account resides on. It resides on set of computers for kids to use, and aso the work station name confirms that.

    so from these 2 messages, is it telling me that the workstation in question is trying to access the computer which generated this failed security audit using the: adminadmin
    username?

    is this accurate?




    Thanks,
Working...
X