Event viewer and security failure audit

Archived from groups: microsoft.public.windowsxp.general (More info?)

I have a windows XP Pro comp wireless networked to a XP Home comp - both
log-in with same admin priveleges and have same user account and password. No
errors with the XP Pro but I keep getting 3 system failure audits on the XP
Home system:

Account Logon-Logon attempt by Microsoft_AuthenticationPack_v1 gives error
code ="incorrect password supplied"

Event ID 529 - unknown user name or password

IPSec services - failed to get the complete list of network interfaces on
the machine .......Please run IPSec snap-in to further diagnose.

I have checked the password log-on has'nt changed. IPSec when activated in
Console does'nt show any errors. I can't see anything obvious and there are
no spyware programs on the XP Home system.
Can anyone shed some light on this for me??
3 answers Last reply
More about event viewer security failure audit
  1. Archived from groups: microsoft.public.windowsxp.general (More info?)

    "RobRW" <RobRW@discussions.microsoft.com> wrote in message
    news:79468C5E-0E88-48E6-8469-28AE962FB49A@microsoft.com...
    > I have a windows XP Pro comp wireless networked to a XP Home comp - both
    > log-in with same admin priveleges and have same user account and password.
    No
    > errors with the XP Pro but I keep getting 3 system failure audits on the
    XP
    > Home system:

    Google found...

    http://support.microsoft.com/default.aspx?scid=kb;en-us;811082

    http://www.jsifaq.com/SUBJ/tip4700/rh4716.htm

    Skip the advert and then scroll down for some ideas here..
    http://www.windowsitpro.com/Article/ArticleID/38309/38309.html?Ad=1
  2. Archived from groups: microsoft.public.windowsxp.general (More info?)

    Nothing to worry about. I get Event ID 529 & 680 all the time.

    [[The event occurred on Windows XP if the machine environment meets the
    following criteria:
    - The machine is a member of a domain.
    - The machine is using a machine local account.
    - Logon failure auditing is enabled.
    When the user logs off, Windows will write event ID 529 to the log file
    because the OS incorrectly tries to contact the domain controller (DC),
    despite the fact that the machine is using a local account. Microsoft
    currently doesn't provide a fix for this problem, but you can safely ignore
    this event ID.]]

    Event Type: Failure Audit
    Event Source: Security
    Event Category: Logon/Logoff
    Event ID: 529
    Date: 12/27/2003
    Time: 7:49:48 AM
    User: NT AUTHORITY\SYSTEM
    Computer: MYPENTIUM450
    Description:
    Logon Failure:
    Reason: Unknown user name or bad password

    Security Event 529 Is Logged for Local User Accounts
    http://support.microsoft.com/?kbid=811082

    Failure Events Are Logged When the Welcome Screen Is Enabled
    http://support.microsoft.com/?kbid=305822

    Event Type: Failure Audit
    Event Source: Security
    Event Category: Account Logon
    Event ID: 680
    Date: 12/27/2003
    Time: 7:49:48 AM
    User: NT AUTHORITY\SYSTEM
    Computer: MYPENTIUM450
    Description:
    Logon attempt by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0

    Explanation
    A program or service attempted to start with the logon credentials specified
    in the message, which do not match the credentials of the current user. This
    message is logged for informational purposes only.

    User Action
    No user action is required.

    Failure Events Are Logged When the Welcome Screen Is Enabled
    http://support.microsoft.com/?kbid=305822

    --
    Hope this helps. Let us know.

    Wes
    MS-MVP Windows Shell/User

    In news:79468C5E-0E88-48E6-8469-28AE962FB49A@microsoft.com,
    RobRW <RobRW@discussions.microsoft.com> hunted and pecked:
    > I have a windows XP Pro comp wireless networked to a XP Home comp - both
    > log-in with same admin priveleges and have same user account and
    > password. No errors with the XP Pro but I keep getting 3 system failure
    > audits on the XP Home system:
    >
    > Account Logon-Logon attempt by Microsoft_AuthenticationPack_v1 gives error
    > code ="incorrect password supplied"
    >
    > Event ID 529 - unknown user name or password
    >
    > IPSec services - failed to get the complete list of network interfaces on
    > the machine .......Please run IPSec snap-in to further diagnose.
    >
    > I have checked the password log-on has'nt changed. IPSec when activated in
    > Console does'nt show any errors. I can't see anything obvious and there
    > are no spyware programs on the XP Home system.
    > Can anyone shed some light on this for me??
  3. Archived from groups: microsoft.public.windowsxp.general (More info?)

    Thankyou to both respondents - your info has helped me. I have turned off
    failure audits for security in event viewer now that I know its not a problem
    with my operating system so that I dont have to scan a long list of fault
    warnings that all relate to above. I trust that if Microsoft eventually
    provides a fix for this that somehow I'll find out about it?

    "Wesley Vogel" wrote:

    > Nothing to worry about. I get Event ID 529 & 680 all the time.
    >
    > [[The event occurred on Windows XP if the machine environment meets the
    > following criteria:
    > - The machine is a member of a domain.
    > - The machine is using a machine local account.
    > - Logon failure auditing is enabled.
    > When the user logs off, Windows will write event ID 529 to the log file
    > because the OS incorrectly tries to contact the domain controller (DC),
    > despite the fact that the machine is using a local account. Microsoft
    > currently doesn't provide a fix for this problem, but you can safely ignore
    > this event ID.]]
    >
    > Event Type: Failure Audit
    > Event Source: Security
    > Event Category: Logon/Logoff
    > Event ID: 529
    > Date: 12/27/2003
    > Time: 7:49:48 AM
    > User: NT AUTHORITY\SYSTEM
    > Computer: MYPENTIUM450
    > Description:
    > Logon Failure:
    > Reason: Unknown user name or bad password
    >
    > Security Event 529 Is Logged for Local User Accounts
    > http://support.microsoft.com/?kbid=811082
    >
    > Failure Events Are Logged When the Welcome Screen Is Enabled
    > http://support.microsoft.com/?kbid=305822
    >
    > Event Type: Failure Audit
    > Event Source: Security
    > Event Category: Account Logon
    > Event ID: 680
    > Date: 12/27/2003
    > Time: 7:49:48 AM
    > User: NT AUTHORITY\SYSTEM
    > Computer: MYPENTIUM450
    > Description:
    > Logon attempt by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
    >
    > Explanation
    > A program or service attempted to start with the logon credentials specified
    > in the message, which do not match the credentials of the current user. This
    > message is logged for informational purposes only.
    >
    > User Action
    > No user action is required.
    >
    > Failure Events Are Logged When the Welcome Screen Is Enabled
    > http://support.microsoft.com/?kbid=305822
    >
    > --
    > Hope this helps. Let us know.
    >
    > Wes
    > MS-MVP Windows Shell/User
    >
    > In news:79468C5E-0E88-48E6-8469-28AE962FB49A@microsoft.com,
    > RobRW <RobRW@discussions.microsoft.com> hunted and pecked:
    > > I have a windows XP Pro comp wireless networked to a XP Home comp - both
    > > log-in with same admin priveleges and have same user account and
    > > password. No errors with the XP Pro but I keep getting 3 system failure
    > > audits on the XP Home system:
    > >
    > > Account Logon-Logon attempt by Microsoft_AuthenticationPack_v1 gives error
    > > code ="incorrect password supplied"
    > >
    > > Event ID 529 - unknown user name or password
    > >
    > > IPSec services - failed to get the complete list of network interfaces on
    > > the machine .......Please run IPSec snap-in to further diagnose.
    > >
    > > I have checked the password log-on has'nt changed. IPSec when activated in
    > > Console does'nt show any errors. I can't see anything obvious and there
    > > are no spyware programs on the XP Home system.
    > > Can anyone shed some light on this for me??
    >
    >
Ask a new question

Read More

Event Viewer Microsoft Windows XP