Re: Event Viewer Entries - Feedback Please

From: JBL (jbl85_at_hotmail.com)
Date: 11/21/04 

Date: Sun, 21 Nov 2004 16:13:27 -0500

Thanks Wesley - I thought I had done that. Here is another entry as I
understood your instructions:

Event Type: Failure Audit
Event Source: Security
Event Category: Logon/Logoff
Event ID: 529
Date: 11/21/2004
Time: 4:03:52 PM
User: NT AUTHORITY\SYSTEM
Computer: FAMILYR
Description:
Logon Failure:
  Reason: Unknown user name or bad password
  User Name: Jeff Lloyd
  Domain: FAMILYR
  Logon Type: 2
  Logon Process: Advapi
  Authentication Package: Negotiate
  Workstation Name: BEDROOM4

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

"Wesley Vogel" <123WVogel955@comcast.net> wrote in message
news:ug0$uyA0EHA.2316@TK2MSFTNGP15.phx.gbl...
> Meaningless without Event ID & the Event Source.
>
> To open the Event Viewer...
> Start | Run | Type: eventvwr | OK
>
> For any Events that seem related to the problem...
>
> Double click the event in Event Viewer | Click: the button below the
> second
> arrow (looks like two pages) [[Copies the details of the event to the
> Clipboard.]] | Paste into Notepad | Click:
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
>
> Read all info | Copy and paste to Notepad | Click the [+] Related
> Knowledge
> Base articles | Follow any links that might be useful
>
> HOW TO: View and Manage Event Logs in Event Viewer in Windows XP
> http://support.microsoft.com/default.aspx?scid=kb;en-us;308427
>
> Sample...
>
> Event Type: Failure Audit
> Event Source: Security
> Event Category: Account Logon
> Event ID: 680
> Date: 12/27/2003
> Time: 7:49:48 AM
> User: NT AUTHORITY\SYSTEM
> Computer: MYPENTIUM450
> Description:
> Logon attempt by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
> Logon account: WESLEY P. VOGEL
> Source Workstation: MYPENTIUM450
> Error Code: 0xC000006E
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
>
> --
> Hope this helps. Let us know.
> Wes
>
> In news:OVmJpnA0EHA.3452@TK2MSFTNGP14.phx.gbl,
> JBL <jbl85@hotmail.com> hunted and pecked:
>> The following entries occur it seems when I log on and are taken from
>> the security log of the event viewer. However, I know my Password
>> and so they do not make any sense. I have the WinXP SP2 Firewall
>> enabled as well as Norton Anti-Virus software running PLUS I am
>> behind a router. Of course you can imagine my concern that someone
>> might be trying to hack my system. Any responses greatly
>> appreciated. Thank you.
>>
>> Logon Failure:
>> Reason: Unknown user name or bad password
>> User Name: *** *********
>> Domain: FAMILYR
>> Logon Type: 2
>> Logon Process: Advapi
>> Authentication Package: Negotiate
>> Workstation Name: FAMILYR
>>
>> For more information, see Help and Support Center at
>> http://go.microsoft.com/fwlink/events.asp
>>
>> ====================================
>>
>> Logon attempt by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
>> Logon account: *** *********
>> Source Workstation: FAMILYR
>> Error Code: 0xC000006A
>>
>>
>> For more information, see Help and Support Center at
>> http://go.microsoft.com/fwlink/events.asp
>