Re: Event viewer and security failure audit

Nothing to worry about. I get Event ID 529 & 680 all the time.

[[The event occurred on Windows XP if the machine environment meets the
following criteria:
- The machine is a member of a domain.
- The machine is using a machine local account.
- Logon failure auditing is enabled.
When the user logs off, Windows will write event ID 529 to the log file
because the OS incorrectly tries to contact the domain controller (DC),
despite the fact that the machine is using a local account. Microsoft
currently doesn't provide a fix for this problem, but you can safely ignore
this event ID.]]

Event Type: Failure Audit
Event Source: Security
Event Category: Logon/Logoff
Event ID: 529
Date: 12/27/2003
Time: 7:49:48 AM
User: NT AUTHORITY\SYSTEM
Computer: MYPENTIUM450
Description:
Logon Failure:
Reason: Unknown user name or bad password

Security Event 529 Is Logged for Local User Accounts
http://support.microsoft.com/?kbid=811082

Failure Events Are Logged When the Welcome Screen Is Enabled
http://support.microsoft.com/?kbid=305822

Event Type: Failure Audit
Event Source: Security
Event Category: Account Logon
Event ID: 680
Date: 12/27/2003
Time: 7:49:48 AM
User: NT AUTHORITY\SYSTEM
Computer: MYPENTIUM450
Description:
Logon attempt by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0

Explanation
A program or service attempted to start with the logon credentials specified
in the message, which do not match the credentials of the current user. This
message is logged for informational purposes only.

User Action
No user action is required.

Failure Events Are Logged When the Welcome Screen Is Enabled
http://support.microsoft.com/?kbid=305822

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In news:79468C5E-0E88-48E6-8469-28AE962FB49A@xxxxxxxxxxxxx,
RobRW <RobRW@xxxxxxxxxxxxxxxxxxxxxxxxx> hunted and pecked:
> I have a windows XP Pro comp wireless networked to a XP Home comp - both
> log-in with same admin priveleges and have same user account and
> password. No errors with the XP Pro but I keep getting 3 system failure
> audits on the XP Home system:
>
> Account Logon-Logon attempt by Microsoft_AuthenticationPack_v1 gives error
> code ="incorrect password supplied"
>
> Event ID 529 - unknown user name or password
>
> IPSec services - failed to get the complete list of network interfaces on
> the machine .......Please run IPSec snap-in to further diagnose.
>
> I have checked the password log-on has'nt changed. IPSec when activated in
> Console does'nt show any errors. I can't see anything obvious and there
> are no spyware programs on the XP Home system.
> Can anyone shed some light on this for me??

.

Relevant Pages

  • Users in Win98 workstations having account locked in Active Direct
    ... We just upgraded a Windows NT 4 domain to Active Directory. ... out (the account lockout police locks an account after 3 failed tries, ... In the DC security logs, I get a lot of errors: ... Logon Failure: ...
    (microsoft.public.win2000.active_directory)
  • W3SVC event ID 100 dictionary attack?!
    ... Windows NT account 'XXXX' due to the following error: Logon failure: unknown ...
    (microsoft.public.inetserver.iis.security)
  • Re: Worrying Security Event
    ... The machine is using a machine local account. ... Logon failure auditing is enabled. ... Windows will write event ID 529 to the log file ...
    (microsoft.public.windowsxp.basics)
  • Re: Event Source: W3SVC Event ID 100
    ... Some Dell installed process running as a service? ... The server was unable to logon the Windows NT account 'IUSR_D8YTGF21' due to ... the following error: Logon failure: account currently disabled. ...
    (microsoft.public.windows.server.general)
  • Logon failure: account currently disabled
    ... I get "logon failure: account currently disabled" when I try to log into ... my Windows 2000 machine. ... I think we are having some unknown domain server ...
    (microsoft.public.windows.server.general)