Curley_Boy 0 Posted September 17, 2002 My event logs keep reporting these events, can anyone shed any light on this plz? Catagory: Account Logon Event ID: 680 User: NT AUTHORITY\SYSTEM Logon attempt by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 Logon account: **** Source Workstation: **** Error Code: 0xC000006A Catagory: Logon/Log off Event ID: 529 User: NT AUTHORITY\SYSTEM Logon Failure: Reason: Unknown user name or bad password User Name: **** Domain: **** Logon Type: 2 Logon Process: Advapi Authentication Package: Negotiate Workstation Name: **** The above events appear 4 times each logon... the system has no other longon probs though, Just these entries. Share this post Link to post
Four and Twenty 0 Posted September 17, 2002 you were disabling services right? did you write down the stuff you changed? Share this post Link to post
adamvjackson 0 Posted September 17, 2002 Quote: Catagory: Account Logon Event ID: 680 User: NT AUTHORITY\SYSTEM Logon attempt by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 Logon account: **** Source Workstation: **** Error Code: 0xC000006A Catagory: Logon/Log off Event ID: 529 User: NT AUTHORITY\SYSTEM The above 3 show up on the event logs in .Net Advanced Server, too. I always assumed that this was the 'system' logging on, as even when you log in as local admin, the machine is also logging in as 'system'. The authentication package.. not sure on this one, but as I said, on a clean, unaltered install of .Net AS this is there, so I assume it is needed. Share this post Link to post
Curley_Boy 0 Posted September 17, 2002 I set up auditing for logon/log off events... As far as I remember it showed up from the start ie clean install (so not likely to be hackers, ditto for Win2000). I've traced it down (I think) to my firewall software which blocks alot of stuff. Not too worry as I clean out the event logs once a week anyhow. Share this post Link to post
