Event ID errors!

Discussion in 'other software & services' started by Narced96, Jul 20, 2005.

Thread Status:
Not open for further replies.
  1. Narced96

    Narced96 Guest

    Event Type: Failure Audit
    Event Source: Security
    Event Category: Logon/Logoff
    Event ID: 529
    Date: 3/2/2004
    Time: 8:00:50 AM
    User: NT AUTHORITY\SYSTEM
    Computer:
    Description:
    Logon Failure:
    Reason: Unknown user name or bad password
    User Name: service_password=
    Domain:
    Logon Type: 5
    Logon Process: Advapi
    Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
    Workstation Name:

    ------------------------------------------------------------

    Source: Secruity
    Category: Account Logon
    Type: Failure Audit
    Event ID: 680
    User: NT AUTHORITY\SYSTEM

    Description:
    Logon attempt by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
    Logon account: "User Name"
    Source Workstation: "Computer Name"
    Error Code: 0xC000006A

    Hello,
    Every time i logon to my PC, i enter my password and logon with no problems at all, but when i go into event viewer, under security i have the following error 2 times, along with error 680 2 times.

    I have tried to find info about this on google , but with no luck. Most info seems to relate to a Server or Professionall setup(xp home- running). I would really like some advice about these two entries.

    i guess what i really would like to know:

    How can I fix these Failure Audits and prevent them from happening again?

    Are these 2 Failure Audits a serious threat to my computer?

    Can someone please help me correct these errors. I am NOT a computer expert
    so for me to understand your generous help and advice, please do not use
    technical computer language and acronymes.

    I am very grateful for any help and advice you generous people out there are
    willing to give me!!! :) :)
     
  2. Matt_Smi

    Matt_Smi Registered Member

    Joined:
    Jul 7, 2004
    Posts:
    359
    I get the same thing, I really don’t know why but I would not worry about it. I check my event log often but never really get too caught up in analyzing it unless I am trying to diagnose a problem. I am pretty sure this is normal, it does not mean something is wrong with your computer. Here is my event log after logging off and back on.
     

    Attached Files:

  3. Narced96

    Narced96 Guest

    Thanks for your reply Matt_Smi, at the moment i'm trying to lock down my computer, while looking through my logs i have ound lots of errros(most i have fixed or configured properly), but i was kinda worried about these 4 i seem to get them all the time.

    Its good to know tha other people get these logs, thats makes me feel a hole lot better.

    cheers ;)
     
  4. ravin

    ravin Registered Member

    Joined:
    May 2, 2003
    Posts:
    241
    Location:
    South Carolina
    you can go to eventid.net type in the source and event id and see posts about these events and thier meaning. :rolleyes:
     
  5. Narced96

    Narced96 Guest

    Hi R,

    Went and had a look at eventid.net for events '529','680'. Still not totally sure if this is a problem or not> This is some info that best describes the kinds things im finding in my logs>

    >The event occurred on Windows XP if the machine environment meets the following criteria:
    - The machine is a member of a domain.
    - The machine is using a machine local account.
    - Logon failure auditing is enabled.
    When the user logs off, Windows will write event ID 529 to the log file because the OS incorrectly tries to contact the domain controller (DC), despite the fact that the machine is using a local account. Microsoft currently doesn't provide a fix for this problem, but you can safely ignore this event ID.


    >According to Microsoft Windows XP attempts a limited logon for each account that is displayed on the Welcome screen to determine whether to prompt the user for a password. An attempted logon is logged for each account displayed. To resolve this problem, obtain the latest service pack for Windows XP. To prevent these events from being logged, disable the Welcome screen and use the classic logon screen or turn off auditing of logon events. See Q305822.


    I don't think i should worry about this, but im not sure to be honest. What do you think?

    Thanks for helping out
     
  6. Bubba

    Bubba Updates Team

    Joined:
    Apr 15, 2002
    Posts:
    11,271
    When first reading about these events....I was running across references to attempts by others to log into your machine can cause these events....the bad

    Then I ran into some of the same articles\comments you just now posted....the good

    To help ease your mind further....do the Security logon\logoff 529\680 ID's correspond to the logon\logoff Services Event ID's....time wise ?
     
  7. Narced96

    Narced96 Guest

    Bubba i think so , but im not to sure. For example futher down in the system logs I have two events logged for user fast switching and in security logs i have two entries for logon/logoff529 and 680logon/logoff. Not sure if they are related as they appear at sightly different intervalls in both logs
     
    Last edited by a moderator: Jul 21, 2005
  8. Narced96

    Narced96 Guest

    Bubba the times are as follows

    System log 23:47:35

    Secuirty log 23:49:28
     
  9. Bubba

    Bubba Updates Team

    Joined:
    Apr 15, 2002
    Posts:
    11,271
    While I know you said you weren't going to worry about this....I too like my event viewer to be clean....lack of a better word.

    However....if you keep an eye on the time correlations....and they do seem to be almost on top of each other....at least you'll be working on a nuisance and nothing bad :doubt:
     
  10. Narced96

    Narced96 Guest


    Bubba my problem is that i always assume the worst(habit i guess)! So you think it looks ok, i guess i thought it wasn't bad, but you never know about these things. I'll keep checking it:)!!

    Thank you all very much for your time and help,

    Narc
     
  11. Sirandar

    Sirandar Guest

    I started getting this message after I installed the PST backup utility from Microsoft
     
Loading...
Thread Status:
Not open for further replies.