Security Log issue. 1

[J741]

In the WIndows XP security log, I have several audit failures which occur at system startup. There are 2 consecutive failures which repeat for every user account on my system.

[tt]The first is event ID 680 caused by source: security
Logon attempt by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon account: <account name>
Source Workstation: <my PC name>
Error Code: 0xC000006A

The second is event ID 529 caused by source: security
Logon Failure:
Reason: Unknown user name or bad password
User Name: <account name>
Domain: <my workgroup name>
Logon Type: 2
Logon Process: Advapi
Authentication Package: Negotiate
Workstation Name: <my PC name>
[/tt]
Both events repeat for every user account on my system, every time I start the computer. I do not see any failed event in the Apllication or System logs which correspond to the time of these Security log events.

What the heck is going on?

- James.

 

[HardwareGuys]

So no one has any idea why this is happening?

 

[Masterpjz9]

Does it stop you from doing anything on your computer? Does it cause an error to come up on the screen? If not, it probably does not matter.

 

[trg2d]

Fist off are you running XP home of XP pro? Second are you logging into a domain or a workgroup? If you are running xp home it will only support workgroups. If you are running xp pro, then my next question would be what type of server is replicating your users login's. Error code 680 means Account is used for login whereas 529 means bad user name and password. So, I would start by ensuring that you server has a trust relationship with the PC, and also check you servers event log for errors.

 

[scholar24]

trg2d has it pretty covered if it's a login attempt onto a server the server permissions are set to high or the admin has removed the account. Try this, turn on error reporting and in the event log click the link and it will ask you to send it to MS, click yes, then it will open the help and support module and if others have recieved the error and MS has built a knowledge base it might list help. I get some random network errors with XP Pro and Netbios but they seem to not effect the network access or system performance/operation.


Tom

 

[linney]

You might want to check out these sites which mention similar problems.

http://www.google.com/search?sourceid=navclient&querytime=8E-E&q=0xC000006A+windows+xp

http://groups.google.com/groups?sourceid=navclient&q=0xC000006A+windows+xp

Part of which includes this........


&quot;Windows XP performs a limited logon for each account that is listed on the Welcome screen, so it will know whether to prompt for a password.
If you don't want these events, disable the Welcome screen and use the Classic logon screen, or turn off auditing of logon/logoff events:

1. Start / Run / gpedit.msc / OK.

2. Navigate to Local Computer Policy \ Computer Configuration \ Windows Settings \ Security Settings \ Local Policy \ Audit Policy

3. Double-click Audit logon events and clear the Success and Failure boxes.

4. Press OK.&quot;

 

[J741]

For those who asked - I'm using WinXP Pro. There is no network (except the internet, and some available but inactive VPN connections). I'm logging in as a standalone PC.

linney, your links were quite helpful. It seems this is normal activity, but it sure is a pain to examine my security event logs. If I'm looking for any unauthorised login attempts, these erroneous and plentiful events get in the way!

Thank you for all your help. I guess I'll just have to put up with is for now, or swith to classic login.

- James.

 

[SQLBill]

Linney,

as James says, thanks for the information. I am running XP Home and get the same error messages. I've been following this thread to see if a solution/explanation ever got posted. Again, thanks for the information. A star to you.

-Bill