Can anyone identify these logon events plz?
This is a discussion about Can anyone identify these logon events plz? in the Windows Security category; My event logs keep reporting these events, can anyone shed any light on this plz? Catagory: Account Logon Event ID: 680 User: NT AUTHORITY\SYSTEM Logon attempt by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 Logon account: **** Source Workstation: **** Error Code: 0xC000006A Catagory: Logon/Log off Event ID: 529 User: NT ...
My event logs keep reporting these events, can anyone shed any light on this plz?
Catagory: Account Logon Event ID: 680
User: NT AUTHORITY\SYSTEM
Logon attempt by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon account: ****
Source Workstation: ****
Error Code: 0xC000006A
Catagory: Logon/Log off Event ID: 529
User: NT AUTHORITY\SYSTEM
Logon Failure:
Reason: Unknown user name or bad password
User Name: ****
Domain: ****
Logon Type: 2
Logon Process: Advapi
Authentication Package: Negotiate
Workstation Name: ****
The above events appear 4 times each logon... the system has no other longon probs though, Just these entries.
Catagory: Account Logon Event ID: 680
User: NT AUTHORITY\SYSTEM
Logon attempt by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon account: ****
Source Workstation: ****
Error Code: 0xC000006A
Catagory: Logon/Log off Event ID: 529
User: NT AUTHORITY\SYSTEM
Logon Failure:
Reason: Unknown user name or bad password
User Name: ****
Domain: ****
Logon Type: 2
Logon Process: Advapi
Authentication Package: Negotiate
Workstation Name: ****
The above events appear 4 times each logon... the system has no other longon probs though, Just these entries.
Participate in our website and join the conversation
This subject has been archived. New comments and votes cannot be submitted.
Sep 17
Sep 18
0
2 minutes
Responses to this topic
you were disabling services right?
did you write down the stuff you changed?
did you write down the stuff you changed?
Quote:Catagory: Account Logon Event ID: 680
User: NT AUTHORITY\SYSTEM
Logon attempt by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon account: ****
Source Workstation: ****
Error Code: 0xC000006A
Catagory: Logon/Log off Event ID: 529
User: NT AUTHORITY\SYSTEM
The above 3 show up on the event logs in .Net Advanced Server, too. I always assumed that this was the 'system' logging on, as even when you log in as local admin, the machine is also logging in as 'system'. The authentication package.. not sure on this one, but as I said, on a clean, unaltered install of .Net AS this is there, so I assume it is needed.
User: NT AUTHORITY\SYSTEM
Logon attempt by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon account: ****
Source Workstation: ****
Error Code: 0xC000006A
Catagory: Logon/Log off Event ID: 529
User: NT AUTHORITY\SYSTEM
The above 3 show up on the event logs in .Net Advanced Server, too. I always assumed that this was the 'system' logging on, as even when you log in as local admin, the machine is also logging in as 'system'. The authentication package.. not sure on this one, but as I said, on a clean, unaltered install of .Net AS this is there, so I assume it is needed.
OP
I set up auditing for logon/log off events...
As far as I remember it showed up from the start ie clean install (so not likely to be hackers, ditto for Win2000).
I've traced it down (I think) to my firewall software which blocks alot of stuff. Not too worry as I clean out the event logs once a week anyhow.
As far as I remember it showed up from the start ie clean install (so not likely to be hackers, ditto for Win2000).
I've traced it down (I think) to my firewall software which blocks alot of stuff. Not too worry as I clean out the event logs once a week anyhow.
