Sign in with
Sign up | Sign in
Your question

Failure Audit in secruity log Event Viewer

Last response: in Windows XP
Share
Anonymous
April 12, 2005 12:01:02 AM

Archived from groups: microsoft.public.windowsxp.help_and_support (More info?)

Hello fellow Newsgroup members. :-)

I have a computer running Windows XP Home Editon. This is a stand alone
computer, it is not connected to a network.

Since I have had my computer there are always 3 different Failure Audits
shown in the secruity log in the Event Viewer. The Event Viewer is under
Aministrative Tools in the Start Menu.

When I click on the Failure Audit event messages in the Event Viewer this is
the information given for each of the 3 different Failure Audits:

1ST FAILURE AUDIT:

Source: Secruity
Category: Policy Change
Type: Failure Audit
Event ID: 615
User: NT AUTHORITY\NETWORK SERVICE

Description:
IPSec Services: IPSec Services failed to get the complete list of network
interfaces on the machine. This can be a potential security hazard to the
machine since some of the network interfaces may not get the protection as
desired by the applied IPSec filters. Please run IPSec monitor snap-in to
further diagnose the problem.
--------------------------------------------------------------------------------
I have tried to run the IPSec monitor snap-in but I could not figure out how
to use it. I clicked on the help link in the error message but the
information in the help web site is too technical for me to understand.

This event, 615 Policy Change, has a Failure Audit when the computer starts
and sometimes has a Success Audit straight after.


2ND FAILURE AUDIT:

Source: Secruity
Category: Account Logon
Type: Failure Audit
Event ID: 680
User: NT AUTHORITY\SYSTEM

Description:
Logon attempt by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon account: "User Name"
Source Workstation: "Computer Name"
Error Code: 0xC000006A
----------------------------------------------------------------------------------
This event, 680 Account Logon, always has a Failure Audit when the computer
starts and always has a Success Audit straight after.

3RD FAILURE AUDIT:

Source: Secruity
Category: Logon/Logoff
Type: Failure Audit
Event ID: 529
User: NT AUTHORITY\SYSTEM

Description:
Logon Failure:
Reason: Unknown user name or bad password
User Name: "User Name"
Domain: "Computer Name"
Logon Type: 2
Logon Process: Advapi
Authentication Package: Negotiate
Workstation Name: "Computer Name"
---------------------------------------------------------------------------------
I do have a password created for my Windows XP Account, which is an
administrators account. I enter the password on the welcome screen and I can
log on with no problem. So why do I have this error which says that there is
an "unknown user name or bad password" when I am able to log on perfectly??

This event, 529 Logon/Logoff, always has a Failure Audit. It has never had
a Success Audit!!! But like I said, I am always able to log on to my Windows
XP account using my user name and password at the welcome screen everytime.

QUESTIONS ABOUT THESE FAILURE AUDITS:

What are the causes of each of these 3 Failure Audits?

How can I fix these Failure Audits and prevent them from happening again?

Are these 3 Failure Audits a serious threat to my computer?

Can someone please help me correct these errors. I am NOT a computer expert
so for me to understand your generous help and advice, please do not use
technical computer language and acronymes.

I am very grateful for any help and advice you generous people out there are
willing to give me!!! :-) :-)

THANK YOU,

Techno Phobe.
Anonymous
April 12, 2005 12:34:34 PM

Archived from groups: microsoft.public.windowsxp.help_and_support (More info?)

Have a look here:
http://www.eventid.net/display.asp?eventid=615

"Techno Phobe" <TechnoPhobe@discussions.microsoft.com> escribió en el mensaje news:7A2772AF-BBA8-4355-BF99-CBBBE91B4F12@microsoft.com...
> Hello fellow Newsgroup members. :-)
>
> I have a computer running Windows XP Home Editon. This is a stand alone
> computer, it is not connected to a network.
>
> Since I have had my computer there are always 3 different Failure Audits
> shown in the secruity log in the Event Viewer. The Event Viewer is under
> Aministrative Tools in the Start Menu.
>
> When I click on the Failure Audit event messages in the Event Viewer this is
> the information given for each of the 3 different Failure Audits:
>
> 1ST FAILURE AUDIT:
>
> Source: Secruity
> Category: Policy Change
> Type: Failure Audit
> Event ID: 615
> User: NT AUTHORITY\NETWORK SERVICE
>
> Description:
> IPSec Services: IPSec Services failed to get the complete list of network
> interfaces on the machine. This can be a potential security hazard to the
> machine since some of the network interfaces may not get the protection as
> desired by the applied IPSec filters. Please run IPSec monitor snap-in to
> further diagnose the problem.
> --------------------------------------------------------------------------------
> I have tried to run the IPSec monitor snap-in but I could not figure out how
> to use it. I clicked on the help link in the error message but the
> information in the help web site is too technical for me to understand.
>
> This event, 615 Policy Change, has a Failure Audit when the computer starts
> and sometimes has a Success Audit straight after.
>
>
> 2ND FAILURE AUDIT:
>
> Source: Secruity
> Category: Account Logon
> Type: Failure Audit
> Event ID: 680
> User: NT AUTHORITY\SYSTEM
>
> Description:
> Logon attempt by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
> Logon account: "User Name"
> Source Workstation: "Computer Name"
> Error Code: 0xC000006A
> ----------------------------------------------------------------------------------
> This event, 680 Account Logon, always has a Failure Audit when the computer
> starts and always has a Success Audit straight after.
>
> 3RD FAILURE AUDIT:
>
> Source: Secruity
> Category: Logon/Logoff
> Type: Failure Audit
> Event ID: 529
> User: NT AUTHORITY\SYSTEM
>
> Description:
> Logon Failure:
> Reason: Unknown user name or bad password
> User Name: "User Name"
> Domain: "Computer Name"
> Logon Type: 2
> Logon Process: Advapi
> Authentication Package: Negotiate
> Workstation Name: "Computer Name"
> ---------------------------------------------------------------------------------
> I do have a password created for my Windows XP Account, which is an
> administrators account. I enter the password on the welcome screen and I can
> log on with no problem. So why do I have this error which says that there is
> an "unknown user name or bad password" when I am able to log on perfectly??
>
> This event, 529 Logon/Logoff, always has a Failure Audit. It has never had
> a Success Audit!!! But like I said, I am always able to log on to my Windows
> XP account using my user name and password at the welcome screen everytime.
>
> QUESTIONS ABOUT THESE FAILURE AUDITS:
>
> What are the causes of each of these 3 Failure Audits?
>
> How can I fix these Failure Audits and prevent them from happening again?
>
> Are these 3 Failure Audits a serious threat to my computer?
>
> Can someone please help me correct these errors. I am NOT a computer expert
> so for me to understand your generous help and advice, please do not use
> technical computer language and acronymes.
>
> I am very grateful for any help and advice you generous people out there are
> willing to give me!!! :-) :-)
>
> THANK YOU,
>
> Techno Phobe.
!