Re: Failure Audit in secruity log Event Viewer

Have a look here:
http://www.eventid.net/display.asp?eventid=615

"Techno Phobe" <TechnoPhobe@xxxxxxxxxxxxxxxxxxxxxxxxx> escribió en el mensaje news:7A2772AF-BBA8-4355-BF99-CBBBE91B4F12@xxxxxxxxxxxxxxxx
> Hello fellow Newsgroup members. :-)
>
> I have a computer running Windows XP Home Editon. This is a stand alone
> computer, it is not connected to a network.
>
> Since I have had my computer there are always 3 different Failure Audits
> shown in the secruity log in the Event Viewer. The Event Viewer is under
> Aministrative Tools in the Start Menu.
>
> When I click on the Failure Audit event messages in the Event Viewer this is
> the information given for each of the 3 different Failure Audits:
>
> 1ST FAILURE AUDIT:
>
> Source: Secruity
> Category: Policy Change
> Type: Failure Audit
> Event ID: 615
> User: NT AUTHORITY\NETWORK SERVICE
>
> Description:
> IPSec Services: IPSec Services failed to get the complete list of network
> interfaces on the machine. This can be a potential security hazard to the
> machine since some of the network interfaces may not get the protection as
> desired by the applied IPSec filters. Please run IPSec monitor snap-in to
> further diagnose the problem.
> --------------------------------------------------------------------------------
> I have tried to run the IPSec monitor snap-in but I could not figure out how
> to use it. I clicked on the help link in the error message but the
> information in the help web site is too technical for me to understand.
>
> This event, 615 Policy Change, has a Failure Audit when the computer starts
> and sometimes has a Success Audit straight after.
>
>
> 2ND FAILURE AUDIT:
>
> Source: Secruity
> Category: Account Logon
> Type: Failure Audit
> Event ID: 680
> User: NT AUTHORITY\SYSTEM
>
> Description:
> Logon attempt by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
> Logon account: "User Name"
> Source Workstation: "Computer Name"
> Error Code: 0xC000006A
> ----------------------------------------------------------------------------------
> This event, 680 Account Logon, always has a Failure Audit when the computer
> starts and always has a Success Audit straight after.
>
> 3RD FAILURE AUDIT:
>
> Source: Secruity
> Category: Logon/Logoff
> Type: Failure Audit
> Event ID: 529
> User: NT AUTHORITY\SYSTEM
>
> Description:
> Logon Failure:
> Reason: Unknown user name or bad password
> User Name: "User Name"
> Domain: "Computer Name"
> Logon Type: 2
> Logon Process: Advapi
> Authentication Package: Negotiate
> Workstation Name: "Computer Name"
> ---------------------------------------------------------------------------------
> I do have a password created for my Windows XP Account, which is an
> administrators account. I enter the password on the welcome screen and I can
> log on with no problem. So why do I have this error which says that there is
> an "unknown user name or bad password" when I am able to log on perfectly??
>
> This event, 529 Logon/Logoff, always has a Failure Audit. It has never had
> a Success Audit!!! But like I said, I am always able to log on to my Windows
> XP account using my user name and password at the welcome screen everytime.
>
> QUESTIONS ABOUT THESE FAILURE AUDITS:
>
> What are the causes of each of these 3 Failure Audits?
>
> How can I fix these Failure Audits and prevent them from happening again?
>
> Are these 3 Failure Audits a serious threat to my computer?
>
> Can someone please help me correct these errors. I am NOT a computer expert
> so for me to understand your generous help and advice, please do not use
> technical computer language and acronymes.
>
> I am very grateful for any help and advice you generous people out there are
> willing to give me!!! :-) :-)
>
> THANK YOU,
>
> Techno Phobe.
.

Relevant Pages

  • Re: Event Log - Security - Numerous Failures
    ... For Event-ID 529 I have read now more possibile reasons (i.e. dictionary ... If it should be a dictionary attach on your Administrator account try to ... > Event Type: Failure Audit ... > The logon to account: ...
    (microsoft.public.windows.server.security)
  • Re: AD accounts randomly locking on 1st login attempt
    ... Is the account logged into more than one machine or is it running a service ... Event Type: Failure Audit ... Logon Failure: ... Logon Process: Advapi ...
    (microsoft.public.windows.server.active_directory)
  • Re: Failure Audit errors
    ... We have to unlock her account in AD to get the user back on. ... security event logs from the user Windows XP PC: ... An error occurred during logon ... http://go.microsoft.com/fwlink/events.asp.Event Type: Failure Audit ...
    (microsoft.public.windows.server.general)
  • Re: Failure Audits in the secruity log Event Viewer
    ... Windows XP Home/Professional Events and Errors ... The machine is using a machine local account. ... Logon failure auditing is enabled. ... Event Type: Failure Audit ...
    (microsoft.public.windowsxp.security_admin)
  • Re: Failure Audit in secruity log Event Viewer
    ... Windows XP Home/Professional Events and Errors ... - Logon failure auditing is enabled. ... despite the fact that the machine is using a local account. ... Event Type: Failure Audit ...
    (microsoft.public.windowsxp.help_and_support)
Loading