Audit Log Shows Multiple Failed Log On Attempts

  • Thread starter Thread starter David
  • Start date Start date
D

David

It appears as though there is a script running somewhere
that initiates an attempt to log on using my account
every 5 minutes...all day long. The audit log shows this:

Event Type: Failure Audit
Event Source: Security
Event Category: Account Logon
Event ID: 680
Date: 9/27/2003
Time: 10:58:00 AM
User: NT AUTHORITY\SYSTEM
Computer: JOHNDAVID
Description:
Logon attempt by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon account: david
Source Workstation: JOHNDAVID
Error Code: 0xC0000234


For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

Eventually, it shows a successful "Account Locked Out"
log. So far, I'm baffled. I really need to get to the
source of this. I feel like someone from an outside
source is breaking in. Thanks a lot.
 
Do you have your firewall enabled? If not, do so at once, or get a third
party hardware or software firewall. Block *all* inbound traffic by default.
 
Back
Top