Event ID errors!

Event Type: Failure Audit
Event Source: Security
Event Category: Logon/Logoff
Event ID: 529
Date: 3/2/2004
Time: 8:00:50 AM
User: NT AUTHORITY\SYSTEM
Computer:
Description:
Logon Failure:
Reason: Unknown user name or bad password
User Name: service_password=
Domain:
Logon Type: 5
Logon Process: Advapi
Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Workstation Name:

------------------------------------------------------------

Source: Secruity
Category: Account Logon
Type: Failure Audit
Event ID: 680
User: NT AUTHORITY\SYSTEM

Description:
Logon attempt by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon account: "User Name"
Source Workstation: "Computer Name"
Error Code: 0xC000006A

Hello,
Every time i logon to my PC, i enter my password and logon with no problems at all, but when i go into event viewer, under security i have the following error 2 times, along with error 680 2 times.

I have tried to find info about this on google , but with no luck. Most info seems to relate to a Server or Professionall setup(xp home- running). I would really like some advice about these two entries.

i guess what i really would like to know:

How can I fix these Failure Audits and prevent them from happening again?

Are these 2 Failure Audits a serious threat to my computer?

Can someone please help me correct these errors. I am NOT a computer expert
so for me to understand your generous help and advice, please do not use
technical computer language and acronymes.

I am very grateful for any help and advice you generous people out there are
willing to give me!!!

 

I get the same thing, I really don’t know why but I would not worry about it. I check my event log often but never really get too caught up in analyzing it unless I am trying to diagnose a problem. I am pretty sure this is normal, it does not mean something is wrong with your computer. Here is my event log after logging off and back on.

 

Thanks for your reply Matt_Smi, at the moment i'm trying to lock down my computer, while looking through my logs i have ound lots of errros(most i have fixed or configured properly), but i was kinda worried about these 4 i seem to get them all the time.

Its good to know tha other people get these logs, thats makes me feel a hole lot better.

cheers

 

you can go to eventid.net type in the source and event id and see posts about these events and thier meaning.

 

Hi R,

Went and had a look at eventid.net for events '529','680'. Still not totally sure if this is a problem or not> This is some info that best describes the kinds things im finding in my logs>

>The event occurred on Windows XP if the machine environment meets the following criteria:
- The machine is a member of a domain.
- The machine is using a machine local account.
- Logon failure auditing is enabled.
When the user logs off, Windows will write event ID 529 to the log file because the OS incorrectly tries to contact the domain controller (DC), despite the fact that the machine is using a local account. Microsoft currently doesn't provide a fix for this problem, but you can safely ignore this event ID.


>According to Microsoft Windows XP attempts a limited logon for each account that is displayed on the Welcome screen to determine whether to prompt the user for a password. An attempted logon is logged for each account displayed. To resolve this problem, obtain the latest service pack for Windows XP. To prevent these events from being logged, disable the Welcome screen and use the classic logon screen or turn off auditing of logon events. See Q305822.


I don't think i should worry about this, but im not sure to be honest. What do you think?

Thanks for helping out

 

When first reading about these events....I was running across references to attempts by others to log into your machine can cause these events....the bad

Then I ran into some of the same articles\comments you just now posted....the good

To help ease your mind further....do the Security logon\logoff 529\680 ID's correspond to the logon\logoff Services Event ID's....time wise ?

 

Bubba i think so , but im not to sure. For example futher down in the system logs I have two events logged for user fast switching and in security logs i have two entries for logon/logoff529 and 680logon/logoff. Not sure if they are related as they appear at sightly different intervalls in both logs

 

Bubba the times are as follows

System log 23:47:35

Secuirty log 23:49:28

 

While I know you said you weren't going to worry about this....I too like my event viewer to be clean....lack of a better word.

However....if you keep an eye on the time correlations....and they do seem to be almost on top of each other....at least you'll be working on a nuisance and nothing bad

 

Bubba my problem is that i always assume the worst(habit i guess)! So you think it looks ok, i guess i thought it wasn't bad, but you never know about these things. I'll keep checking it!!

Thank you all very much for your time and help,

Narc

 

I started getting this message after I installed the PST backup utility from Microsoft