Failure Audit in secruity log Event Viewer

Archived from groups: microsoft.public.windowsxp.help_and_support (More info?)

Hello fellow Newsgroup members. :-)

I have a computer running Windows XP Home Editon. This is a stand alone
computer, it is not connected to a network.

Since I have had my computer there are always 3 different Failure Audits
shown in the secruity log in the Event Viewer. The Event Viewer is under
Aministrative Tools in the Start Menu.

When I click on the Failure Audit event messages in the Event Viewer this is
the information given for each of the 3 different Failure Audits:

1ST FAILURE AUDIT:

Source: Secruity
Category: Policy Change
Type: Failure Audit
Event ID: 615
User: NT AUTHORITY\NETWORK SERVICE

Description:
IPSec Services: IPSec Services failed to get the complete list of network
interfaces on the machine. This can be a potential security hazard to the
machine since some of the network interfaces may not get the protection as
desired by the applied IPSec filters. Please run IPSec monitor snap-in to
further diagnose the problem.
--------------------------------------------------------------------------------
I have tried to run the IPSec monitor snap-in but I could not figure out how
to use it. I clicked on the help link in the error message but the
information in the help web site is too technical for me to understand.

This event, 615 Policy Change, has a Failure Audit when the computer starts
and sometimes has a Success Audit straight after.


2ND FAILURE AUDIT:

Source: Secruity
Category: Account Logon
Type: Failure Audit
Event ID: 680
User: NT AUTHORITY\SYSTEM

Description:
Logon attempt by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon account: "User Name"
Source Workstation: "Computer Name"
Error Code: 0xC000006A
----------------------------------------------------------------------------------
This event, 680 Account Logon, always has a Failure Audit when the computer
starts and always has a Success Audit straight after.

3RD FAILURE AUDIT:

Source: Secruity
Category: Logon/Logoff
Type: Failure Audit
Event ID: 529
User: NT AUTHORITY\SYSTEM

Description:
Logon Failure:
Reason: Unknown user name or bad password
User Name: "User Name"
Domain: "Computer Name"
Logon Type: 2
Logon Process: Advapi
Authentication Package: Negotiate
Workstation Name: "Computer Name"
---------------------------------------------------------------------------------
I do have a password created for my Windows XP Account, which is an
administrators account. I enter the password on the welcome screen and I can
log on with no problem. So why do I have this error which says that there is
an "unknown user name or bad password" when I am able to log on perfectly??

This event, 529 Logon/Logoff, always has a Failure Audit. It has never had
a Success Audit!!! But like I said, I am always able to log on to my Windows
XP account using my user name and password at the welcome screen everytime.

QUESTIONS ABOUT THESE FAILURE AUDITS:

What are the causes of each of these 3 Failure Audits?

How can I fix these Failure Audits and prevent them from happening again?

Are these 3 Failure Audits a serious threat to my computer?

Can someone please help me correct these errors. I am NOT a computer expert
so for me to understand your generous help and advice, please do not use
technical computer language and acronymes.

I am very grateful for any help and advice you generous people out there are
willing to give me!!! :-) :-)

THANK YOU,

Techno Phobe.
1 answer Last reply
More about failure audit secruity event viewer
  1. Archived from groups: microsoft.public.windowsxp.help_and_support (More info?)

    Have a look here:
    http://www.eventid.net/display.asp?eventid=615

    "Techno Phobe" <TechnoPhobe@discussions.microsoft.com> escribió en el mensaje news:7A2772AF-BBA8-4355-BF99-CBBBE91B4F12@microsoft.com...
    > Hello fellow Newsgroup members. :-)
    >
    > I have a computer running Windows XP Home Editon. This is a stand alone
    > computer, it is not connected to a network.
    >
    > Since I have had my computer there are always 3 different Failure Audits
    > shown in the secruity log in the Event Viewer. The Event Viewer is under
    > Aministrative Tools in the Start Menu.
    >
    > When I click on the Failure Audit event messages in the Event Viewer this is
    > the information given for each of the 3 different Failure Audits:
    >
    > 1ST FAILURE AUDIT:
    >
    > Source: Secruity
    > Category: Policy Change
    > Type: Failure Audit
    > Event ID: 615
    > User: NT AUTHORITY\NETWORK SERVICE
    >
    > Description:
    > IPSec Services: IPSec Services failed to get the complete list of network
    > interfaces on the machine. This can be a potential security hazard to the
    > machine since some of the network interfaces may not get the protection as
    > desired by the applied IPSec filters. Please run IPSec monitor snap-in to
    > further diagnose the problem.
    > --------------------------------------------------------------------------------
    > I have tried to run the IPSec monitor snap-in but I could not figure out how
    > to use it. I clicked on the help link in the error message but the
    > information in the help web site is too technical for me to understand.
    >
    > This event, 615 Policy Change, has a Failure Audit when the computer starts
    > and sometimes has a Success Audit straight after.
    >
    >
    > 2ND FAILURE AUDIT:
    >
    > Source: Secruity
    > Category: Account Logon
    > Type: Failure Audit
    > Event ID: 680
    > User: NT AUTHORITY\SYSTEM
    >
    > Description:
    > Logon attempt by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
    > Logon account: "User Name"
    > Source Workstation: "Computer Name"
    > Error Code: 0xC000006A
    > ----------------------------------------------------------------------------------
    > This event, 680 Account Logon, always has a Failure Audit when the computer
    > starts and always has a Success Audit straight after.
    >
    > 3RD FAILURE AUDIT:
    >
    > Source: Secruity
    > Category: Logon/Logoff
    > Type: Failure Audit
    > Event ID: 529
    > User: NT AUTHORITY\SYSTEM
    >
    > Description:
    > Logon Failure:
    > Reason: Unknown user name or bad password
    > User Name: "User Name"
    > Domain: "Computer Name"
    > Logon Type: 2
    > Logon Process: Advapi
    > Authentication Package: Negotiate
    > Workstation Name: "Computer Name"
    > ---------------------------------------------------------------------------------
    > I do have a password created for my Windows XP Account, which is an
    > administrators account. I enter the password on the welcome screen and I can
    > log on with no problem. So why do I have this error which says that there is
    > an "unknown user name or bad password" when I am able to log on perfectly??
    >
    > This event, 529 Logon/Logoff, always has a Failure Audit. It has never had
    > a Success Audit!!! But like I said, I am always able to log on to my Windows
    > XP account using my user name and password at the welcome screen everytime.
    >
    > QUESTIONS ABOUT THESE FAILURE AUDITS:
    >
    > What are the causes of each of these 3 Failure Audits?
    >
    > How can I fix these Failure Audits and prevent them from happening again?
    >
    > Are these 3 Failure Audits a serious threat to my computer?
    >
    > Can someone please help me correct these errors. I am NOT a computer expert
    > so for me to understand your generous help and advice, please do not use
    > technical computer language and acronymes.
    >
    > I am very grateful for any help and advice you generous people out there are
    > willing to give me!!! :-) :-)
    >
    > THANK YOU,
    >
    > Techno Phobe.
Ask a new question

Read More

Event Viewer Computers Windows XP