Event ID 681

[Guest]

Archived from groups: microsoft.public.win2000.general (More info?)

Recently I began noticing Event ID 681 errors in the security logs of our
Microsoft ISA Server 2000. These errors are only occuring on 2 specific
workstations/user accounts. The event log reads as follows:
-----------------------------------------
Date: 3/3/2005
Time: 8:33
Type: Failure
User: NT AUTHORITYSYSTEM
Computer: SERVERNAME
Source: Security
Category: Account Logon
Event ID: 681

Description:
The logon to account: USERNAME
by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
from workstation: WORKSTATIONNAME
failed. The error code was: 3221225572
-----------------------------------------

This error message is being generated atleast every minute, if not 2 or 3
times a minute and has been occuring since last week sometime. I made several
changes on our ISA server last week so that ISA would log user names rather
than IP addresses. It seems that these error messages began appearing after
that. I find it strange, however, that only 2 users are experiencing this. We
have approximately 50 users total and all other accounts seem fine. I have
verified that the firewall client is installed and configure properly on
these 2 workstations. I have also tried renaming these workstations.

The changes made to ISA last week were as follows:

>Open SCPFIRE properties>incoming web requests, check the box ?Ask unauthenticated users for identification?.

>Access policy>Site & Content rules>Change proxy rule to apply to Accounts:Everyone as opposed to any request (eliminates anonymous access).

Any ideas how to eliminate this problem from recurring?

I've also obtained a hotfix from MS, which did not work (KB837142).

Thanks in advance - Wayne

 

[Guest]

Archived from groups: microsoft.public.win2000.general (More info?)

Did you take a look here:

http://eventid.net/display.asp?eventid=681&eventno=3&source=Security&phase=1

Might be something there that can help.

John

waynebk wrote:

> Recently I began noticing Event ID 681 errors in the security logs of our
> Microsoft ISA Server 2000. These errors are only occuring on 2 specific
> workstations/user accounts. The event log reads as follows:
> -----------------------------------------
> Date: 3/3/2005
> Time: 8:33
> Type: Failure
> User: NT AUTHORITYSYSTEM
> Computer: SERVERNAME
> Source: Security
> Category: Account Logon
> Event ID: 681
>
> Description:
> The logon to account: USERNAME
> by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
> from workstation: WORKSTATIONNAME
> failed. The error code was: 3221225572
> -----------------------------------------
>
> This error message is being generated atleast every minute, if not 2 or 3
> times a minute and has been occuring since last week sometime. I made several
> changes on our ISA server last week so that ISA would log user names rather
> than IP addresses. It seems that these error messages began appearing after
> that. I find it strange, however, that only 2 users are experiencing this. We
> have approximately 50 users total and all other accounts seem fine. I have
> verified that the firewall client is installed and configure properly on
> these 2 workstations. I have also tried renaming these workstations.
>
> The changes made to ISA last week were as follows:
>
>
>>Open SCPFIRE properties>incoming web requests, check the box ?Ask unauthenticated users for identification?.
>
>
>>Access policy>Site & Content rules>Change proxy rule to apply to Accounts:Everyone as opposed to any request (eliminates anonymous access).
>
>
> Any ideas how to eliminate this problem from recurring?
>
> I've also obtained a hotfix from MS, which did not work (KB837142).
>
> Thanks in advance - Wayne