Event Id 680
10 comments for event id 680 from source Security. Windows Event Log Analysis Splunk App Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to www.eventid.net. Caller Logon ID: (0x0,0x3E4) Caller Process ID: 144 Transited Services: - Source Network Address: XX.XX.XX.XX Source Port: 55707. Event Type: Failure Audit Event Source: Security Event Category: Account Logon Event ID: 680 Date: Time: 22.01.45 User: NT AUTHORITY SYSTEM Computer: WEB1. Windows XP Home Event Id 680, Failure Audit. DVanTassel asked on 2003-06-11. OS Security; 24 Comments. Last Modified: 2013-12-04.
event id 529 and 680
Nov 24, 2011 04:42 PM|twisterice|LINK
Hello,
i'm very frustrated because i've not still found a fix to my issue:
i've win2003 r2 standard with a website called web1 and a virtual directory called vir1...now, on the property of vir1 i've changed the authentication to basic because a my customer needs to connect to this app via web services using a local user (user1) that i've created on this web server. So in this property of vir1, instead of using IUSR_SERVER i've used this local user.
This portal has worked fine for a long time but recently for unknown reason every time inside my web app (built in .net) i try to use the download function that point to download a file inside vir1, it show me 401.1 error telling me that i've no rights to view or bad password.
Infact in the event viewer i receive event id 529 and 680...WHAT'S WRONG? i've tried lot of things such as cscript adsutil.vbs set w3svc/indetifier/root/vir1/NTAuthenticationProviders 'negotiate,NTLM' or simply 'NTLM' but nothing to do....HELP!!!!
Event Type: Failure Audit
Event Source: Security
Event Category: Logon/Logoff
Event ID: 529
Date: 24/11/2011
Time: 22.01.45
User: NT AUTHORITYSYSTEM
Computer: WEB1
Description:
Logon Failure:
Reason: Unknown user name or bad password
User Name: USER1
Domain: WEB1
Logon Type: 8
Logon Process: Advapi
Authentication Package: Negotiate
Workstation Name: WEB1
Caller User Name: NETWORK SERVICE
Caller Domain: NT AUTHORITY
Caller Logon ID: (0x0,0x3E4)
Caller Process ID: 144
Transited Services: -
Source Network Address: XX.XX.XX.XX
Source Port: 55707
Event Id 6801
and 680 event
Event Id 680 Error Code 0xc000006a
Event Type: Failure Audit
Event Source: Security
Event Category: Account Logon
Event ID: 680
Date: 24/11/2011
Time: 22.01.45
User: NT AUTHORITYSYSTEM
Computer: WEB1
Description:
Logon attempt by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon account: USER1
Source Workstation: WEB1
Error Code: 0xC000006A
Event Id 6803 Adsync