Event Viewer Entries - Feedback Please

J

JBL

The following entries occur it seems when I log on and are taken from the
security log of the event viewer. However, I know my Password and so they
do not make any sense. I have the WinXP SP2 Firewall enabled as well as
Norton Anti-Virus software running PLUS I am behind a router. Of course you
can imagine my concern that someone might be trying to hack my system. Any
responses greatly appreciated. Thank you.

Logon Failure:
Reason: Unknown user name or bad password
User Name: *** *********
Domain: FAMILYR
Logon Type: 2
Logon Process: Advapi
Authentication Package: Negotiate
Workstation Name: FAMILYR

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp

====================================

Logon attempt by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon account: *** *********
Source Workstation: FAMILYR
Error Code: 0xC000006A


For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp
 
W

Wesley Vogel

Meaningless without Event ID & the Event Source.

To open the Event Viewer...
Start | Run | Type: eventvwr | OK

For any Events that seem related to the problem...

Double click the event in Event Viewer | Click: the button below the second
arrow (looks like two pages) [[Copies the details of the event to the
Clipboard.]] | Paste into Notepad | Click:
For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

Read all info | Copy and paste to Notepad | Click the [+] Related Knowledge
Base articles | Follow any links that might be useful

HOW TO: View and Manage Event Logs in Event Viewer in Windows XP
http://support.microsoft.com/default.aspx?scid=kb;en-us;308427

Sample...

Event Type: Failure Audit
Event Source: Security
Event Category: Account Logon
Event ID: 680
Date: 12/27/2003
Time: 7:49:48 AM
User: NT AUTHORITY\SYSTEM
Computer: MYPENTIUM450
Description:
Logon attempt by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon account: WESLEY P. VOGEL
Source Workstation: MYPENTIUM450
Error Code: 0xC000006E

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
 
J

JBL

Thanks Wesley - I thought I had done that. Here is another entry as I
understood your instructions:

Event Type: Failure Audit
Event Source: Security
Event Category: Logon/Logoff
Event ID: 529
Date: 11/21/2004
Time: 4:03:52 PM
User: NT AUTHORITY\SYSTEM
Computer: FAMILYR
Description:
Logon Failure:
Reason: Unknown user name or bad password
User Name: Jeff Lloyd
Domain: FAMILYR
Logon Type: 2
Logon Process: Advapi
Authentication Package: Negotiate
Workstation Name: BEDROOM4


For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

Wesley Vogel said:
Meaningless without Event ID & the Event Source.

To open the Event Viewer...
Start | Run | Type: eventvwr | OK

For any Events that seem related to the problem...

Double click the event in Event Viewer | Click: the button below the
second
arrow (looks like two pages) [[Copies the details of the event to the
Clipboard.]] | Paste into Notepad | Click:
For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

Read all info | Copy and paste to Notepad | Click the [+] Related
Knowledge
Base articles | Follow any links that might be useful

HOW TO: View and Manage Event Logs in Event Viewer in Windows XP
http://support.microsoft.com/default.aspx?scid=kb;en-us;308427

Sample...

Event Type: Failure Audit
Event Source: Security
Event Category: Account Logon
Event ID: 680
Date: 12/27/2003
Time: 7:49:48 AM
User: NT AUTHORITY\SYSTEM
Computer: MYPENTIUM450
Description:
Logon attempt by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon account: WESLEY P. VOGEL
Source Workstation: MYPENTIUM450
Error Code: 0xC000006E

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

--
Hope this helps. Let us know.
Wes

In
JBL said:
The following entries occur it seems when I log on and are taken from
the security log of the event viewer. However, I know my Password
and so they do not make any sense. I have the WinXP SP2 Firewall
enabled as well as Norton Anti-Virus software running PLUS I am
behind a router. Of course you can imagine my concern that someone
might be trying to hack my system. Any responses greatly
appreciated. Thank you.

Logon Failure:
Reason: Unknown user name or bad password
User Name: *** *********
Domain: FAMILYR
Logon Type: 2
Logon Process: Advapi
Authentication Package: Negotiate
Workstation Name: FAMILYR

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp

====================================

Logon attempt by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon account: *** *********
Source Workstation: FAMILYR
Error Code: 0xC000006A


For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp
Click to expand...
Click to expand...
 
W

Wesley Vogel

Jeff,

You did good! :)

[[The event occurred on Windows XP if the machine environment meets the
following criteria:
- The machine is a member of a domain.
- The machine is using a machine local account.
- Logon failure auditing is enabled.
When the user logs off, Windows will write event ID 529 to the log file
because
the OS incorrectly tries to contact the domain controller (DC), despite the
fact that the machine is using a local account. Microsoft currently doesn't
provide a fix for this problem, but you can safely ignore this event ID.]]

Security Event 529 Is Logged for Local User Accounts
http://support.microsoft.com/default.aspx?scid=kb;en-us;811082

Failure Events Are Logged When the Welcome Screen Is Enabled
http://support.microsoft.com/default.aspx?scid=kb;en-us;305822

Click on 529 here >>>
Windows XP Professional Events and Errors Search Results
for "Security 529"
http://tinyurl.com/5qbp3

For future reference, you can use this...

You need to have the Event ID & the Event Source.

Windows XP Professional Events and Errors
http://www.microsoft.com/technet/su...ows Operating System&MajorMinor=5.1&LCID=1033

--
Hope this helps. Let us know.
Wes

In
JBL said:
Thanks Wesley - I thought I had done that. Here is another entry as I
understood your instructions:

Event Type: Failure Audit
Event Source: Security
Event Category: Logon/Logoff
Event ID: 529
Date: 11/21/2004
Time: 4:03:52 PM
User: NT AUTHORITY\SYSTEM
Computer: FAMILYR
Description:
Logon Failure:
Reason: Unknown user name or bad password
User Name: Jeff Lloyd
Domain: FAMILYR
Logon Type: 2
Logon Process: Advapi
Authentication Package: Negotiate
Workstation Name: BEDROOM4


For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

Wesley Vogel said:
Meaningless without Event ID & the Event Source.

To open the Event Viewer...
Start | Run | Type: eventvwr | OK

For any Events that seem related to the problem...

Double click the event in Event Viewer | Click: the button below the
second
arrow (looks like two pages) [[Copies the details of the event to the
Clipboard.]] | Paste into Notepad | Click:
For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

Read all info | Copy and paste to Notepad | Click the [+] Related
Knowledge
Base articles | Follow any links that might be useful

HOW TO: View and Manage Event Logs in Event Viewer in Windows XP
http://support.microsoft.com/default.aspx?scid=kb;en-us;308427

Sample...

Event Type: Failure Audit
Event Source: Security
Event Category: Account Logon
Event ID: 680
Date: 12/27/2003
Time: 7:49:48 AM
User: NT AUTHORITY\SYSTEM
Computer: MYPENTIUM450
Description:
Logon attempt by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon account: WESLEY P. VOGEL
Source Workstation: MYPENTIUM450
Error Code: 0xC000006E

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

--
Hope this helps. Let us know.
Wes

In
JBL said:
The following entries occur it seems when I log on and are taken
from the security log of the event viewer. However, I know my
Password and so they do not make any sense. I have the WinXP SP2
Firewall enabled as well as Norton Anti-Virus software running PLUS
I am behind a router. Of course you can imagine my concern that
someone might be trying to hack my system. Any responses greatly
appreciated. Thank you.

Logon Failure:
Reason: Unknown user name or bad password
User Name: *** *********
Domain: FAMILYR
Logon Type: 2
Logon Process: Advapi
Authentication Package: Negotiate
Workstation Name: FAMILYR

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp

====================================

Logon attempt by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon account: *** *********
Source Workstation: FAMILYR
Error Code: 0xC000006A


For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp
Click to expand...
Click to expand...
Click to expand...
 
J

JBL

Wes - thank you very much for the info. I am saving this for future
reference!


Wesley Vogel said:
Jeff,

You did good! :)

[[The event occurred on Windows XP if the machine environment meets the
following criteria:
- The machine is a member of a domain.
- The machine is using a machine local account.
- Logon failure auditing is enabled.
When the user logs off, Windows will write event ID 529 to the log file
because
the OS incorrectly tries to contact the domain controller (DC), despite
the
fact that the machine is using a local account. Microsoft currently
doesn't
provide a fix for this problem, but you can safely ignore this event ID.]]

Security Event 529 Is Logged for Local User Accounts
http://support.microsoft.com/default.aspx?scid=kb;en-us;811082

Failure Events Are Logged When the Welcome Screen Is Enabled
http://support.microsoft.com/default.aspx?scid=kb;en-us;305822

Click on 529 here >>>
Windows XP Professional Events and Errors Search Results
for "Security 529"
http://tinyurl.com/5qbp3

For future reference, you can use this...

You need to have the Event ID & the Event Source.

Windows XP Professional Events and Errors
http://www.microsoft.com/technet/su...ows Operating System&MajorMinor=5.1&LCID=1033

--
Hope this helps. Let us know.
Wes

In
JBL said:
Thanks Wesley - I thought I had done that. Here is another entry as I
understood your instructions:

Event Type: Failure Audit
Event Source: Security
Event Category: Logon/Logoff
Event ID: 529
Date: 11/21/2004
Time: 4:03:52 PM
User: NT AUTHORITY\SYSTEM
Computer: FAMILYR
Description:
Logon Failure:
Reason: Unknown user name or bad password
User Name: Jeff Lloyd
Domain: FAMILYR
Logon Type: 2
Logon Process: Advapi
Authentication Package: Negotiate
Workstation Name: BEDROOM4


For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

Wesley Vogel said:
Meaningless without Event ID & the Event Source.

To open the Event Viewer...
Start | Run | Type: eventvwr | OK

For any Events that seem related to the problem...

Double click the event in Event Viewer | Click: the button below the
second
arrow (looks like two pages) [[Copies the details of the event to the
Clipboard.]] | Paste into Notepad | Click:
For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

Read all info | Copy and paste to Notepad | Click the [+] Related
Knowledge
Base articles | Follow any links that might be useful

HOW TO: View and Manage Event Logs in Event Viewer in Windows XP
http://support.microsoft.com/default.aspx?scid=kb;en-us;308427

Sample...

Event Type: Failure Audit
Event Source: Security
Event Category: Account Logon
Event ID: 680
Date: 12/27/2003
Time: 7:49:48 AM
User: NT AUTHORITY\SYSTEM
Computer: MYPENTIUM450
Description:
Logon attempt by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon account: WESLEY P. VOGEL
Source Workstation: MYPENTIUM450
Error Code: 0xC000006E

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

--
Hope this helps. Let us know.
Wes

In JBL <[email protected]> hunted and pecked:
The following entries occur it seems when I log on and are taken
from the security log of the event viewer. However, I know my
Password and so they do not make any sense. I have the WinXP SP2
Firewall enabled as well as Norton Anti-Virus software running PLUS
I am behind a router. Of course you can imagine my concern that
someone might be trying to hack my system. Any responses greatly
appreciated. Thank you.

Logon Failure:
Reason: Unknown user name or bad password
User Name: *** *********
Domain: FAMILYR
Logon Type: 2
Logon Process: Advapi
Authentication Package: Negotiate
Workstation Name: FAMILYR

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp

====================================

Logon attempt by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon account: *** *********
Source Workstation: FAMILYR
Error Code: 0xC000006A


For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp
Click to expand...
Click to expand...
Click to expand...
 
W

Wesley Vogel

Jeff,

You betcha! That's what I do. Keep having fun! :)

--
Hope this helps. Let us know.
Wes

In
JBL said:
Wes - thank you very much for the info. I am saving this for future
reference!


Wesley Vogel said:
Jeff,

You did good! :)

[[The event occurred on Windows XP if the machine environment meets
the following criteria:
- The machine is a member of a domain.
- The machine is using a machine local account.
- Logon failure auditing is enabled.
When the user logs off, Windows will write event ID 529 to the log
file because
the OS incorrectly tries to contact the domain controller (DC),
despite the
fact that the machine is using a local account. Microsoft currently
doesn't
provide a fix for this problem, but you can safely ignore this event
ID.]]

Security Event 529 Is Logged for Local User Accounts
http://support.microsoft.com/default.aspx?scid=kb;en-us;811082

Failure Events Are Logged When the Welcome Screen Is Enabled
http://support.microsoft.com/default.aspx?scid=kb;en-us;305822

Click on 529 here >>>
Windows XP Professional Events and Errors Search Results
for "Security 529"
http://tinyurl.com/5qbp3

For future reference, you can use this...

You need to have the Event ID & the Event Source.

Windows XP Professional Events and Errors
http://www.microsoft.com/technet/su...ows Operating System&MajorMinor=5.1&LCID=1033

--
Hope this helps. Let us know.
Wes

In
JBL said:
Thanks Wesley - I thought I had done that. Here is another entry
as I understood your instructions:

Event Type: Failure Audit
Event Source: Security
Event Category: Logon/Logoff
Event ID: 529
Date: 11/21/2004
Time: 4:03:52 PM
User: NT AUTHORITY\SYSTEM
Computer: FAMILYR
Description:
Logon Failure:
Reason: Unknown user name or bad password
User Name: Jeff Lloyd
Domain: FAMILYR
Logon Type: 2
Logon Process: Advapi
Authentication Package: Negotiate
Workstation Name: BEDROOM4


For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

Meaningless without Event ID & the Event Source.

To open the Event Viewer...
Start | Run | Type: eventvwr | OK

For any Events that seem related to the problem...

Double click the event in Event Viewer | Click: the button below
the second
arrow (looks like two pages) [[Copies the details of the event to
the Clipboard.]] | Paste into Notepad | Click:
For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

Read all info | Copy and paste to Notepad | Click the [+] Related
Knowledge
Base articles | Follow any links that might be useful

HOW TO: View and Manage Event Logs in Event Viewer in Windows XP
http://support.microsoft.com/default.aspx?scid=kb;en-us;308427

Sample...

Event Type: Failure Audit
Event Source: Security
Event Category: Account Logon
Event ID: 680
Date: 12/27/2003
Time: 7:49:48 AM
User: NT AUTHORITY\SYSTEM
Computer: MYPENTIUM450
Description:
Logon attempt by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon account: WESLEY P. VOGEL
Source Workstation: MYPENTIUM450
Error Code: 0xC000006E

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

--
Hope this helps. Let us know.
Wes

In JBL <[email protected]> hunted and pecked:
The following entries occur it seems when I log on and are taken
from the security log of the event viewer. However, I know my
Password and so they do not make any sense. I have the WinXP SP2
Firewall enabled as well as Norton Anti-Virus software running
PLUS I am behind a router. Of course you can imagine my concern
that someone might be trying to hack my system. Any responses
greatly appreciated. Thank you.

Logon Failure:
Reason: Unknown user name or bad password
User Name: *** *********
Domain: FAMILYR
Logon Type: 2
Logon Process: Advapi
Authentication Package: Negotiate
Workstation Name: FAMILYR

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp

====================================

Logon attempt by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon account: *** *********
Source Workstation: FAMILYR
Error Code: 0xC000006A


For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp
Click to expand...
Click to expand...
Click to expand...
 

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments. After that, you can post your question and our members will help you out.

Ask a Question

Similar Threads

Account Logon in Event Viewer... 1
Log file full of security problems! 3
The user has not been granted the requested - Error Code 534 & 538 7
New error Please HELP ME 3
NTbackup fails after running fine for 1 years 1
Please help me in resolving the logon type 2 1
Login/Logoff 1
Security System detected an attempted downgrade attack... 1

Top