One of our server are getting EVENT ID 529 and 680 every 10minutes. I tried to search the internet but with no success.
Source is from the localhost and Username is pointing to USERNAME which does not exist on the server. I replaced the Computer name to XXXXXXXXX. Please help
Event Type: Failure Audit
Event Source: Security
Event Category: Account Logon
Event ID: 680
Date: 3/8/2013
Time: 9:48:37 PM
User: NT AUTHORITY\SYSTEM
Computer: XXXXXXXXXXXXXXXXXX
Description:
Logon attempt by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon account: USERNAME
Source Workstation: HOST
Error Code: 0xC0000064
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Failure Audit
Event Source: Security
Event Category: Logon/Logoff
Event ID: 529
Date: 3/8/2013
Time: 9:38:37 PM
User: NT AUTHORITY\SYSTEM
Computer: XXXXXXXXXXXXXXXXX
Description:
Logon Failure:
Reason: Unknown user name or bad password
User Name: USERNAME
Domain: DOMAIN
Logon Type: 3
Logon Process: NtLmSsp
Authentication Package: NTLM
Workstation Name: HOST
Caller User Name: -
Caller Domain: -
Caller Logon ID: -
Caller Process ID: -
Transited Services: -
Source Network Address: 127.0.0.1
Source Port: 2979
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.