Event Viewer Entries - Feedback Please

The following entries occur it seems when I log on and are taken from the
security log of the event viewer. However, I know my Password and so they
do not make any sense. I have the WinXP SP2 Firewall enabled as well as
Norton Anti-Virus software running PLUS I am behind a router. Of course you
can imagine my concern that someone might be trying to hack my system. Any
responses greatly appreciated. Thank you.

Logon Failure:
Reason: Unknown user name or bad password
User Name: *** *********
Domain: FAMILYR
Logon Type: 2
Logon Process: Advapi
Authentication Package: Negotiate
Workstation Name: FAMILYR

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp

====================================

Logon attempt by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon account: *** *********
Source Workstation: FAMILYR
Error Code: 0xC000006A


For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp

Meaningless without Event ID & the Event Source.

To open the Event Viewer...
Start | Run | Type: eventvwr | OK

For any Events that seem related to the problem...

Double click the event in Event Viewer | Click: the button below the second
arrow (looks like two pages) [[Copies the details of the event to the
Clipboard.]] | Paste into Notepad | Click:
For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

Read all info | Copy and paste to Notepad | Click the [+] Related Knowledge
Base articles | Follow any links that might be useful

HOW TO: View and Manage Event Logs in Event Viewer in Windows XP
http://support.microsoft.com/defaul...kb;en-us;308427

Sample...

Event Type: Failure Audit
Event Source: Security
Event Category: Account Logon
Event ID: 680
Date: 12/27/2003
Time: 7:49:48 AM
User: NT AUTHORITY\SYSTEM
Computer: MYPENTIUM450
Description:
Logon attempt by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon account: WESLEY P. VOGEL
Source Workstation: MYPENTIUM450
Error Code: 0xC000006E

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

--
Hope this helps. Let us know.
Wes

In news:OVmJpnA0EHA.3452@TK2MSFTNGP14.phx.gbl,
JBL <jbl85@hotmail.com> hunted and pecked:
> The following entries occur it seems when I log on and are taken from
> the security log of the event viewer. However, I know my Password
> and so they do not make any sense. I have the WinXP SP2 Firewall
> enabled as well as Norton Anti-Virus software running PLUS I am
> behind a router. Of course you can imagine my concern that someone
> might be trying to hack my system. Any responses greatly
> appreciated. Thank you.
>
> Logon Failure:
> Reason: Unknown user name or bad password
> User Name: *** *********
> Domain: FAMILYR
> Logon Type: 2
> Logon Process: Advapi
> Authentication Package: Negotiate
> Workstation Name: FAMILYR
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp
>
> ====================================
>
> Logon attempt by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
> Logon account: *** *********
> Source Workstation: FAMILYR
> Error Code: 0xC000006A
>
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp

Thanks Wesley - I thought I had done that. Here is another entry as I
understood your instructions:

Event Type: Failure Audit
Event Source: Security
Event Category: Logon/Logoff
Event ID: 529
Date: 11/21/2004
Time: 4:03:52 PM
User: NT AUTHORITY\SYSTEM
Computer: FAMILYR
Description:
Logon Failure:
Reason: Unknown user name or bad password
User Name: Jeff Lloyd
Domain: FAMILYR
Logon Type: 2
Logon Process: Advapi
Authentication Package: Negotiate
Workstation Name: BEDROOM4


For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

"Wesley Vogel" <123WVogel955@comcast.net> wrote in message
news:ug0$uyA0EHA.2316@TK2MSFTNGP15.phx.gbl...
> Meaningless without Event ID & the Event Source.
>
> To open the Event Viewer...
> Start | Run | Type: eventvwr | OK
>
> For any Events that seem related to the problem...
>
> Double click the event in Event Viewer | Click: the button below the
> second
> arrow (looks like two pages) [[Copies the details of the event to the
> Clipboard.]] | Paste into Notepad | Click:
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
>
> Read all info | Copy and paste to Notepad | Click the [+] Related
> Knowledge
> Base articles | Follow any links that might be useful
>
> HOW TO: View and Manage Event Logs in Event Viewer in Windows XP
> http://support.microsoft.com/defaul...kb;en-us;308427
>
> Sample...
>
> Event Type: Failure Audit
> Event Source: Security
> Event Category: Account Logon
> Event ID: 680
> Date: 12/27/2003
> Time: 7:49:48 AM
> User: NT AUTHORITY\SYSTEM
> Computer: MYPENTIUM450
> Description:
> Logon attempt by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
> Logon account: WESLEY P. VOGEL
> Source Workstation: MYPENTIUM450
> Error Code: 0xC000006E
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
>
> --
> Hope this helps. Let us know.
> Wes
>
> In news:OVmJpnA0EHA.3452@TK2MSFTNGP14.phx.gbl,
> JBL <jbl85@hotmail.com> hunted and pecked:
>> The following entries occur it seems when I log on and are taken from
>> the security log of the event viewer. However, I know my Password
>> and so they do not make any sense. I have the WinXP SP2 Firewall
>> enabled as well as Norton Anti-Virus software running PLUS I am
>> behind a router. Of course you can imagine my concern that someone
>> might be trying to hack my system. Any responses greatly
>> appreciated. Thank you.
>>
>> Logon Failure:
>> Reason: Unknown user name or bad password
>> User Name: *** *********
>> Domain: FAMILYR
>> Logon Type: 2
>> Logon Process: Advapi
>> Authentication Package: Negotiate
>> Workstation Name: FAMILYR
>>
>> For more information, see Help and Support Center at
>> http://go.microsoft.com/fwlink/events.asp
>>
>> ====================================
>>
>> Logon attempt by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
>> Logon account: *** *********
>> Source Workstation: FAMILYR
>> Error Code: 0xC000006A
>>
>>
>> For more information, see Help and Support Center at
>> http://go.microsoft.com/fwlink/events.asp
>

Jeff,

You did good! :-)

[[The event occurred on Windows XP if the machine environment meets the
following criteria:
- The machine is a member of a domain.
- The machine is using a machine local account.
- Logon failure auditing is enabled.
When the user logs off, Windows will write event ID 529 to the log file
because
the OS incorrectly tries to contact the domain controller (DC), despite the
fact that the machine is using a local account. Microsoft currently doesn't
provide a fix for this problem, but you can safely ignore this event ID.]]

Security Event 529 Is Logged for Local User Accounts
http://support.microsoft.com/defaul...kb;en-us;811082

Failure Events Are Logged When the Welcome Screen Is Enabled
http://support.microsoft.com/defaul...kb;en-us;305822

Click on 529 here >>>
Windows XP Professional Events and Errors Search Results
for "Security 529"
http://tinyurl.com/5qbp3

For future reference, you can use this...

You need to have the Event ID & the Event Source.

Windows XP Professional Events and Errors
http://www.microsoft.com/technet/su...r=5.1&LCID=1033

--
Hope this helps. Let us know.
Wes

In news:%23oBg68A0EHA.3468@TK2MSFTNGP14.phx.gbl,
JBL <jbl85@hotmail.com> hunted and pecked:
> Thanks Wesley - I thought I had done that. Here is another entry as I
> understood your instructions:
>
> Event Type: Failure Audit
> Event Source: Security
> Event Category: Logon/Logoff
> Event ID: 529
> Date: 11/21/2004
> Time: 4:03:52 PM
> User: NT AUTHORITY\SYSTEM
> Computer: FAMILYR
> Description:
> Logon Failure:
> Reason: Unknown user name or bad password
> User Name: Jeff Lloyd
> Domain: FAMILYR
> Logon Type: 2
> Logon Process: Advapi
> Authentication Package: Negotiate
> Workstation Name: BEDROOM4
>
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
>
> "Wesley Vogel" <123WVogel955@comcast.net> wrote in message
> news:ug0$uyA0EHA.2316@TK2MSFTNGP15.phx.gbl...
>> Meaningless without Event ID & the Event Source.
>>
>> To open the Event Viewer...
>> Start | Run | Type: eventvwr | OK
>>
>> For any Events that seem related to the problem...
>>
>> Double click the event in Event Viewer | Click: the button below the
>> second
>> arrow (looks like two pages) [[Copies the details of the event to the
>> Clipboard.]] | Paste into Notepad | Click:
>> For more information, see Help and Support Center at
>> http://go.microsoft.com/fwlink/events.asp.
>>
>> Read all info | Copy and paste to Notepad | Click the [+] Related
>> Knowledge
>> Base articles | Follow any links that might be useful
>>
>> HOW TO: View and Manage Event Logs in Event Viewer in Windows XP
>> http://support.microsoft.com/defaul...kb;en-us;308427
>>
>> Sample...
>>
>> Event Type: Failure Audit
>> Event Source: Security
>> Event Category: Account Logon
>> Event ID: 680
>> Date: 12/27/2003
>> Time: 7:49:48 AM
>> User: NT AUTHORITY\SYSTEM
>> Computer: MYPENTIUM450
>> Description:
>> Logon attempt by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
>> Logon account: WESLEY P. VOGEL
>> Source Workstation: MYPENTIUM450
>> Error Code: 0xC000006E
>>
>> For more information, see Help and Support Center at
>> http://go.microsoft.com/fwlink/events.asp.
>>
>> --
>> Hope this helps. Let us know.
>> Wes
>>
>> In news:OVmJpnA0EHA.3452@TK2MSFTNGP14.phx.gbl,
>> JBL <jbl85@hotmail.com> hunted and pecked:
>>> The following entries occur it seems when I log on and are taken
>>> from the security log of the event viewer. However, I know my
>>> Password and so they do not make any sense. I have the WinXP SP2
>>> Firewall enabled as well as Norton Anti-Virus software running PLUS
>>> I am behind a router. Of course you can imagine my concern that
>>> someone might be trying to hack my system. Any responses greatly
>>> appreciated. Thank you.
>>>
>>> Logon Failure:
>>> Reason: Unknown user name or bad password
>>> User Name: *** *********
>>> Domain: FAMILYR
>>> Logon Type: 2
>>> Logon Process: Advapi
>>> Authentication Package: Negotiate
>>> Workstation Name: FAMILYR
>>>
>>> For more information, see Help and Support Center at
>>> http://go.microsoft.com/fwlink/events.asp
>>>
>>> ====================================
>>>
>>> Logon attempt by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
>>> Logon account: *** *********
>>> Source Workstation: FAMILYR
>>> Error Code: 0xC000006A
>>>
>>>
>>> For more information, see Help and Support Center at
>>> http://go.microsoft.com/fwlink/events.asp

Wes - thank you very much for the info. I am saving this for future
reference!


"Wesley Vogel" <123WVogel955@comcast.net> wrote in message
news:%238sO3OB0EHA.1204@TK2MSFTNGP10.phx.gbl...
> Jeff,
>
> You did good! :-)
>
> [[The event occurred on Windows XP if the machine environment meets the
> following criteria:
> - The machine is a member of a domain.
> - The machine is using a machine local account.
> - Logon failure auditing is enabled.
> When the user logs off, Windows will write event ID 529 to the log file
> because
> the OS incorrectly tries to contact the domain controller (DC), despite
> the
> fact that the machine is using a local account. Microsoft currently
> doesn't
> provide a fix for this problem, but you can safely ignore this event ID.]]
>
> Security Event 529 Is Logged for Local User Accounts
> http://support.microsoft.com/defaul...kb;en-us;811082
>
> Failure Events Are Logged When the Welcome Screen Is Enabled
> http://support.microsoft.com/defaul...kb;en-us;305822
>
> Click on 529 here >>>
> Windows XP Professional Events and Errors Search Results
> for "Security 529"
> http://tinyurl.com/5qbp3
>
> For future reference, you can use this...
>
> You need to have the Event ID & the Event Source.
>
> Windows XP Professional Events and Errors
> http://www.microsoft.com/technet/su...r=5.1&LCID=1033
>
> --
> Hope this helps. Let us know.
> Wes
>
> In news:%23oBg68A0EHA.3468@TK2MSFTNGP14.phx.gbl,
> JBL <jbl85@hotmail.com> hunted and pecked:
>> Thanks Wesley - I thought I had done that. Here is another entry as I
>> understood your instructions:
>>
>> Event Type: Failure Audit
>> Event Source: Security
>> Event Category: Logon/Logoff
>> Event ID: 529
>> Date: 11/21/2004
>> Time: 4:03:52 PM
>> User: NT AUTHORITY\SYSTEM
>> Computer: FAMILYR
>> Description:
>> Logon Failure:
>> Reason: Unknown user name or bad password
>> User Name: Jeff Lloyd
>> Domain: FAMILYR
>> Logon Type: 2
>> Logon Process: Advapi
>> Authentication Package: Negotiate
>> Workstation Name: BEDROOM4
>>
>>
>> For more information, see Help and Support Center at
>> http://go.microsoft.com/fwlink/events.asp.
>>
>> "Wesley Vogel" <123WVogel955@comcast.net> wrote in message
>> news:ug0$uyA0EHA.2316@TK2MSFTNGP15.phx.gbl...
>>> Meaningless without Event ID & the Event Source.
>>>
>>> To open the Event Viewer...
>>> Start | Run | Type: eventvwr | OK
>>>
>>> For any Events that seem related to the problem...
>>>
>>> Double click the event in Event Viewer | Click: the button below the
>>> second
>>> arrow (looks like two pages) [[Copies the details of the event to the
>>> Clipboard.]] | Paste into Notepad | Click:
>>> For more information, see Help and Support Center at
>>> http://go.microsoft.com/fwlink/events.asp.
>>>
>>> Read all info | Copy and paste to Notepad | Click the [+] Related
>>> Knowledge
>>> Base articles | Follow any links that might be useful
>>>
>>> HOW TO: View and Manage Event Logs in Event Viewer in Windows XP
>>> http://support.microsoft.com/defaul...kb;en-us;308427
>>>
>>> Sample...
>>>
>>> Event Type: Failure Audit
>>> Event Source: Security
>>> Event Category: Account Logon
>>> Event ID: 680
>>> Date: 12/27/2003
>>> Time: 7:49:48 AM
>>> User: NT AUTHORITY\SYSTEM
>>> Computer: MYPENTIUM450
>>> Description:
>>> Logon attempt by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
>>> Logon account: WESLEY P. VOGEL
>>> Source Workstation: MYPENTIUM450
>>> Error Code: 0xC000006E
>>>
>>> For more information, see Help and Support Center at
>>> http://go.microsoft.com/fwlink/events.asp.
>>>
>>> --
>>> Hope this helps. Let us know.
>>> Wes
>>>
>>> In news:OVmJpnA0EHA.3452@TK2MSFTNGP14.phx.gbl,
>>> JBL <jbl85@hotmail.com> hunted and pecked:
>>>> The following entries occur it seems when I log on and are taken
>>>> from the security log of the event viewer. However, I know my
>>>> Password and so they do not make any sense. I have the WinXP SP2
>>>> Firewall enabled as well as Norton Anti-Virus software running PLUS
>>>> I am behind a router. Of course you can imagine my concern that
>>>> someone might be trying to hack my system. Any responses greatly
>>>> appreciated. Thank you.
>>>>
>>>> Logon Failure:
>>>> Reason: Unknown user name or bad password
>>>> User Name: *** *********
>>>> Domain: FAMILYR
>>>> Logon Type: 2
>>>> Logon Process: Advapi
>>>> Authentication Package: Negotiate
>>>> Workstation Name: FAMILYR
>>>>
>>>> For more information, see Help and Support Center at
>>>> http://go.microsoft.com/fwlink/events.asp
>>>>
>>>> ====================================
>>>>
>>>> Logon attempt by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
>>>> Logon account: *** *********
>>>> Source Workstation: FAMILYR
>>>> Error Code: 0xC000006A
>>>>
>>>>
>>>> For more information, see Help and Support Center at
>>>> http://go.microsoft.com/fwlink/events.asp
>

Jeff,

You betcha! That's what I do. Keep having fun! :-)

--
Hope this helps. Let us know.
Wes

In news:uOm9jJE0EHA.1400@TK2MSFTNGP11.phx.gbl,
JBL <jbl85@hotmail.com> hunted and pecked:
> Wes - thank you very much for the info. I am saving this for future
> reference!
>
>
> "Wesley Vogel" <123WVogel955@comcast.net> wrote in message
> news:%238sO3OB0EHA.1204@TK2MSFTNGP10.phx.gbl...
>> Jeff,
>>
>> You did good! :-)
>>
>> [[The event occurred on Windows XP if the machine environment meets
>> the following criteria:
>> - The machine is a member of a domain.
>> - The machine is using a machine local account.
>> - Logon failure auditing is enabled.
>> When the user logs off, Windows will write event ID 529 to the log
>> file because
>> the OS incorrectly tries to contact the domain controller (DC),
>> despite the
>> fact that the machine is using a local account. Microsoft currently
>> doesn't
>> provide a fix for this problem, but you can safely ignore this event
>> ID.]]
>>
>> Security Event 529 Is Logged for Local User Accounts
>> http://support.microsoft.com/defaul...kb;en-us;811082
>>
>> Failure Events Are Logged When the Welcome Screen Is Enabled
>> http://support.microsoft.com/defaul...kb;en-us;305822
>>
>> Click on 529 here >>>
>> Windows XP Professional Events and Errors Search Results
>> for "Security 529"
>> http://tinyurl.com/5qbp3
>>
>> For future reference, you can use this...
>>
>> You need to have the Event ID & the Event Source.
>>
>> Windows XP Professional Events and Errors
>>
http://www.microsoft.com/technet/su...r=5.1&LCID=1033
>>
>> --
>> Hope this helps. Let us know.
>> Wes
>>
>> In news:%23oBg68A0EHA.3468@TK2MSFTNGP14.phx.gbl,
>> JBL <jbl85@hotmail.com> hunted and pecked:
>>> Thanks Wesley - I thought I had done that. Here is another entry
>>> as I understood your instructions:
>>>
>>> Event Type: Failure Audit
>>> Event Source: Security
>>> Event Category: Logon/Logoff
>>> Event ID: 529
>>> Date: 11/21/2004
>>> Time: 4:03:52 PM
>>> User: NT AUTHORITY\SYSTEM
>>> Computer: FAMILYR
>>> Description:
>>> Logon Failure:
>>> Reason: Unknown user name or bad password
>>> User Name: Jeff Lloyd
>>> Domain: FAMILYR
>>> Logon Type: 2
>>> Logon Process: Advapi
>>> Authentication Package: Negotiate
>>> Workstation Name: BEDROOM4
>>>
>>>
>>> For more information, see Help and Support Center at
>>> http://go.microsoft.com/fwlink/events.asp.
>>>
>>> "Wesley Vogel" <123WVogel955@comcast.net> wrote in message
>>> news:ug0$uyA0EHA.2316@TK2MSFTNGP15.phx.gbl...
>>>> Meaningless without Event ID & the Event Source.
>>>>
>>>> To open the Event Viewer...
>>>> Start | Run | Type: eventvwr | OK
>>>>
>>>> For any Events that seem related to the problem...
>>>>
>>>> Double click the event in Event Viewer | Click: the button below
>>>> the second
>>>> arrow (looks like two pages) [[Copies the details of the event to
>>>> the Clipboard.]] | Paste into Notepad | Click:
>>>> For more information, see Help and Support Center at
>>>> http://go.microsoft.com/fwlink/events.asp.
>>>>
>>>> Read all info | Copy and paste to Notepad | Click the [+] Related
>>>> Knowledge
>>>> Base articles | Follow any links that might be useful
>>>>
>>>> HOW TO: View and Manage Event Logs in Event Viewer in Windows XP
>>>> http://support.microsoft.com/defaul...kb;en-us;308427
>>>>
>>>> Sample...
>>>>
>>>> Event Type: Failure Audit
>>>> Event Source: Security
>>>> Event Category: Account Logon
>>>> Event ID: 680
>>>> Date: 12/27/2003
>>>> Time: 7:49:48 AM
>>>> User: NT AUTHORITY\SYSTEM
>>>> Computer: MYPENTIUM450
>>>> Description:
>>>> Logon attempt by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
>>>> Logon account: WESLEY P. VOGEL
>>>> Source Workstation: MYPENTIUM450
>>>> Error Code: 0xC000006E
>>>>
>>>> For more information, see Help and Support Center at
>>>> http://go.microsoft.com/fwlink/events.asp.
>>>>
>>>> --
>>>> Hope this helps. Let us know.
>>>> Wes
>>>>
>>>> In news:OVmJpnA0EHA.3452@TK2MSFTNGP14.phx.gbl,
>>>> JBL <jbl85@hotmail.com> hunted and pecked:
>>>>> The following entries occur it seems when I log on and are taken
>>>>> from the security log of the event viewer. However, I know my
>>>>> Password and so they do not make any sense. I have the WinXP SP2
>>>>> Firewall enabled as well as Norton Anti-Virus software running
>>>>> PLUS I am behind a router. Of course you can imagine my concern
>>>>> that someone might be trying to hack my system. Any responses
>>>>> greatly appreciated. Thank you.
>>>>>
>>>>> Logon Failure:
>>>>> Reason: Unknown user name or bad password
>>>>> User Name: *** *********
>>>>> Domain: FAMILYR
>>>>> Logon Type: 2
>>>>> Logon Process: Advapi
>>>>> Authentication Package: Negotiate
>>>>> Workstation Name: FAMILYR
>>>>>
>>>>> For more information, see Help and Support Center at
>>>>> http://go.microsoft.com/fwlink/events.asp
>>>>>
>>>>> ====================================
>>>>>
>>>>> Logon attempt by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
>>>>> Logon account: *** *********
>>>>> Source Workstation: FAMILYR
>>>>> Error Code: 0xC000006A
>>>>>
>>>>>
>>>>> For more information, see Help and Support Center at
>>>>> http://go.microsoft.com/fwlink/events.asp