bad password for MICROSOFT_AUTHENTICATION_PACKAGE_V1_0

[Guest]

A series of four Failure Audits show up in the Security section of the
Windows XP Event Viewer every time I boot up my Windows XP home computer.
See below. I'm entering my correct password when I login, so I don't know
where the bad password is coming from. Anyone have any idea what's causing
this and how I can get rid of it?

#1
Event Type: Failure Audit
Event Source: Security
Event Category: Account Logon
Event ID: 680
Date: 1/22/2005
Time: 1:29:35 PM
User: NT AUTHORITY\SYSTEM
Computer: xxx
Description:
Logon attempt by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon account: SSS
Source Workstation: xxx
Error Code: 0xC000006A

#2
Event Type: Failure Audit
Event Source: Security
Event Category: Logon/Logoff
Event ID: 529
Date: 1/22/2005
Time: 1:29:35 PM
User: NT AUTHORITY\SYSTEM
Computer: xxx
Description:
Logon Failure:
Reason: Unknown user name or bad password
User Name: SSS
Domain: xxx
Logon Type: 2
Logon Process: Advapi
Authentication Package: Negotiate
Workstation Name: xxx

#3 duplicate of #1
#4 duplicate of #2

 

[Wesley Vogel]

Not to worry.

ID: 680
Source: Security

Explanation
A program or service attempted to start with the logon credentials specified
in the message, which do not match the credentials of the current user. This
message is logged for informational purposes only.

User Action
No user action is required.

Failure Events Are Logged When the Welcome Screen Is Enabled
http://support.microsoft.com/?kbid=305822

===

Event Source: Security
Event Category: Logon/Logoff
Event ID: 529

[[The event occurred on Windows XP if the machine environment meets the
following criteria:
- The machine is a member of a domain.
- The machine is using a machine local account.
- Logon failure auditing is enabled.
When the user logs off, Windows will write event ID 529 to the log file
because
the OS incorrectly tries to contact the domain controller (DC), despite the
fact that the machine is using a local account. Microsoft currently doesn't
provide a fix for this problem, but you can safely ignore this event ID.]]

Security Event 529 Is Logged for Local User Accounts
http://support.microsoft.com/?kbid=811082

Failure Events Are Logged When the Welcome Screen Is Enabled
http://support.microsoft.com/?kbid=305822

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In

 

[bunyip]

Be Worried. Be very worried!

ADVAPI (NB: NOT ADVAPI32 - note the 32) is listed as a worm/trojan by several security sites. Seach ADVAPI for more info.

Also MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 is not a user login ID, is an Authentication Package. It should appear against "Authentication Package:", not "Logon attempt by".

Your PC is most likely infected, but not much info on ADVAPI yet.

Bunyip

A series of four Failure Audits show up in the Security section of the
Windows XP Event Viewer every time I boot up my Windows XP home computer.
See below. I'm entering my correct password when I login, so I don't know
where the bad password is coming from. Anyone have any idea what's causing
this and how I can get rid of it?

#1
Event Type: Failure Audit
Event Source: Security
Event Category: Account Logon
Event ID: 680
Date: 1/22/2005
Time: 1:29:35 PM
User: NT AUTHORITY\SYSTEM
Computer: xxx
Description:
Logon attempt by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon account: SSS
Source Workstation: xxx
Error Code: 0xC000006A

#2
Event Type: Failure Audit
Event Source: Security
Event Category: Logon/Logoff
Event ID: 529
Date: 1/22/2005
Time: 1:29:35 PM
User: NT AUTHORITY\SYSTEM
Computer: xxx
Description:
Logon Failure:
Reason: Unknown user name or bad password
User Name: SSS
Domain: xxx
Logon Type: 2
Logon Process: Advapi
Authentication Package: Negotiate
Workstation Name: xxx

#3 duplicate of #1
#4 duplicate of #2

 

[wguru]

Be worried about this last post

Shame on pcreview forum for not putting this past post in the recycle bin.

While perhaps well meaning, the poster of "Be Worried. Be Very Worried" apparrently hasn't read...

http://www.derkeiler.com/Newsgroups/microsoft.public.windowsxp.security_admin/2005-01/1879.html

https://www.pcreview.co.uk/forums/thread-180085.php