Duplicate Security Log Entries

[Tomas]

When reviewing my Domain Controller security logs for Event 681, I see
multiple (3-4) entries that are completely identical, all the way down to
the time stamp.

The description usually reads something like the following:
-----------------------
The logon to account: <user>
by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
from workstation: <machine name>
failed. The error code was: 3221225578
-----------------------
3221225578 translates to Bad PW, but is not the only error code I have seen
this with

All events look like they occured at the same hh:mm:ss

Anyone know why I am seeing this behaviour, and any way to correct it?

Thanks in advance!

 

[Steven L Umbach]

Hi Thomas. Not sure what is going on, but that is pretty normal to see. I understand
that if W2K has a failed logon in certain situations it will try to logon again
automatically without any user input. That is one reason why MS recommends setting
user lockout threshold to at least ten. -- Steve

 

[Tomas]

Do you know if MS has this documented anywhere?

Thanks!