Quantcast
Channel: Security forum
Viewing all articles
Browse latest Browse all 12072

Event ID 529 and 680 every 10 minutes in Security log

$
0
0

One of our server are getting EVENT ID 529 and 680 every 10minutes. I tried to search the internet but with no success.

Source is from the localhost and Username is pointing to USERNAME which does not exist on the server. I replaced the Computer name to XXXXXXXXX. Please help

Event Type:    Failure Audit
Event Source:    Security
Event Category:    Account Logon
Event ID:    680
Date:        3/8/2013
Time:        9:48:37 PM
User:        NT AUTHORITY\SYSTEM
Computer:    XXXXXXXXXXXXXXXXXX
Description:
Logon attempt by:    MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
 Logon account:    USERNAME
 Source Workstation:    HOST
 Error Code:    0xC0000064


For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.


Event Type:    Failure Audit
Event Source:    Security
Event Category:    Logon/Logoff
Event ID:    529
Date:        3/8/2013
Time:        9:38:37 PM
User:        NT AUTHORITY\SYSTEM
Computer:    XXXXXXXXXXXXXXXXX
Description:
Logon Failure:
     Reason:        Unknown user name or bad password
     User Name:    USERNAME
     Domain:        DOMAIN
     Logon Type:    3
     Logon Process:    NtLmSsp
     Authentication Package:    NTLM
     Workstation Name:    HOST
     Caller User Name:    -
     Caller Domain:    -
     Caller Logon ID:    -
     Caller Process ID:    -
     Transited Services:    -
     Source Network Address:    127.0.0.1
     Source Port:    2979


For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.


Viewing all articles
Browse latest Browse all 12072

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>