Re: Event ID 680

Tech-Archive recommends: Fix windows errors by optimizing your registry

Check out the link below. I haven't seen or heard of this but think this
will help.

http://www.eventid.net/display.asp?eventid=680&eventno=2267&source=Security&phase=1

--


Paul Bergson MCT, MCSE, MCSA, CNE, CNA, CCA

This posting is provided "AS IS" with no warranties, and confers no rights.


"vzrogers" <vzrogers@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:1E910CC2-000E-4A35-868F-0AF6E4C57693@xxxxxxxxxxxxxxxx
> Hello,
>
> The Security Log on one of my 2003 DC's is filling up with a ton of 680
> events, coming from the same source workstation, but with all different
> variables at the end of the machine name. For example, if the machine
> name
> is server1, the sources vary such as server1x, server1R, server10,
> server1G,
> etc.. The user name indicated in the event is consistent and belongs to
> someone in our domain.
>
> The actual event being logged is as follows:
>
> Source: Security
> Category: Account Logon
> Type: Failure Audit
> Event ID: 680
> User: NT Authority\System
> Computer: "DOMAINCONTROLLER"
> Description:
> Logon attempt by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
> Logon account: "user1"
> Source Workstation: "server1X" (** this field varries, as indicated in
> my
> problem description above)
> Error Code: 0xC000006A
>
>
> Does anyone have any idea why this may be occuring, if its malicious,
> etc.?


.