User Logon Errors In Event Logs

[David H.]

Hello,

I think I may have created a problem due to lack of understanding of Users.
I have a PC that was new about 2 months ago, XP Home & SP1.
When I first started using it there where no users set-up, I read on a web site
that you should create a new Admin Account and set a password. I created
a user "DRH" and a <password>. At least that is what I think I did. I have only
just recently started to set it up, But I wonder if there was a user that I just
could have renamed?

I installed a couple of small programs, made some cosmetic tweaks.
I intended to use this PC for myself, till our Family PC died. So I decided to
add
a new user called "Home" full Admin rights. I logged in to "HOME" and made a
few cosmetic changes and tweaks.

At this point I decided to rename my user "DRH" to "AdminGuru"
(A bit of poetic licence, it's very clear I'm not)

After reading up on how to do various Admin tasks and checks I looked in the
event log, and I found some errors and messages relating to the old user "DRH".
They occur whenever you Logon or switch between Users.
I'm not sure how to proceed, I only have "Home" & "AdminGuru" as users?
Why are there still references to user "DRH"

The first 2 are failures, the last group are successes but with User "DRH"
-------------------------------------------------
Source: Security
Category: Account Logon
Type: Failure Aud
Event ID: 680
User: NT AUTHORITY\SYSTEM

Logon attempt by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon account: DRH
Source Workstation: MASTER1
Error Code: 0xC000006A
-----------------------------------------

Source: Security
Category: Logon/Logoff
Type: Failure Aud
Event ID: 529
User: NT AUTHORITY\SYSTEM

Logon Failure:
Reason: Unknown user name or bad password
User Name: DRH
Domain: MASTER1
Logon Type: 2
Logon Process: Advapi
Authentication Package: Negotiate
Workstation Name: MASTER1
=======================================================
=======================================================

Source: Security
Category: Logon/Logoff
Type: Success A
Event ID: 551
User: NT AUTHORITY\SYSTEM

User initiated logoff:
User Name: DRH
Domain: MASTER1
Logon ID: (0x0,0xcb7a)
-----------------------------------------

Source: Security
Category: Logon/Logoff
Type: Success A
Event ID: 538
User: NT AUTHORITY\SYSTEM

User Logoff:
User Name: DRH
Domain: MASTER1
Logon ID: (0x0,0x38C7B)
Logon Type: 2
-----------------------------------------

Source: Security
Category: Logon/Logoff
Type: Success A
Event ID: 528
User: NT AUTHORITY\SYSTEM

Successful Logon:
User Name: DRH
Domain: MASTER1
Logon ID: (0x0,0x38C7B)
Logon Type: 2
Logon Process: User32
Authentication Package: Negotiate
Workstation Name: MASTER1
Logon GUID: {00000000-0000-0000-0000-000000000000}
-----------------------------------------

Source: Service Control Manager
Category: None
Type: Information
Event ID: 7035
User: Master1\DRH

The Remote Access Connection Manager service
was successfully sent a start control.
-----------------------------------------

Source: Service Control Manager
Category: None
Type: Information
Event ID: 7035
User: Master1\DRH

The Fast User Switching Compatibility service
was successfully sent a start control.

 

[David H.]

Hello,

I have an update which may help point to what the problem is.
I went round to a friends to look at is "user" set-up on XP Home.
When he booted his PC up it auto logged him in via XP TeakUI settings.
That made me think, I looked at the settings on his PC in TweakUI LogOn.
There you have an option to show the original "Administrator" User at Logon.

I installed TweakUi on my PC, when I go to the Logon section I see "DRH" ?
Some how Administrator is now DRH, but I can not see how?
I have renamed my "AdminGuru" to "DRH".
I still have the errors in the event log.

Any help would be appreciated.

Many Thanks - David

 

[David H.]

Any ideas anyone?

Is there another place I can post this?
I don't want to ignore this, If I start putting apps on the PC
for my wife & daughter and the thing fails.. I don't want to
have to re-build it again.

I have looked on eventid.com, nothing that really gave me a solution.

Many Thanks - David

 

[Please reply to newsgroup.]

Hello,

I think I may have created a problem due to lack of understanding of Users.
I have a PC that was new about 2 months ago, XP Home & SP1.
When I first started using it there where no users set-up, I read on a web site
that you should create a new Admin Account and set a password. I created
a user "DRH" and a <password>. At least that is what I think I did. I have only
just recently started to set it up, But I wonder if there was a user that I just
could have renamed?

I installed a couple of small programs, made some cosmetic tweaks.
I intended to use this PC for myself, till our Family PC died. So I decided to
add
a new user called "Home" full Admin rights. I logged in to "HOME" and made a
few cosmetic changes and tweaks.

At this point I decided to rename my user "DRH" to "AdminGuru"
(A bit of poetic licence, it's very clear I'm not)

After reading up on how to do various Admin tasks and checks I looked in the
event log, and I found some errors and messages relating to the old user "DRH".
They occur whenever you Logon or switch between Users.
I'm not sure how to proceed, I only have "Home" & "AdminGuru" as users?
Why are there still references to user "DRH"

The first 2 are failures, the last group are successes but with User "DRH"
-------------------------------------------------
Source: Security
Category: Account Logon
Type: Failure Aud
Event ID: 680
User: NT AUTHORITY\SYSTEM

Logon attempt by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon account: DRH
Source Workstation: MASTER1
Error Code: 0xC000006A
-----------------------------------------

Source: Security
Category: Logon/Logoff
Type: Failure Aud
Event ID: 529
User: NT AUTHORITY\SYSTEM

Logon Failure:
Reason: Unknown user name or bad password
User Name: DRH
Domain: MASTER1
Logon Type: 2
Logon Process: Advapi
Authentication Package: Negotiate
Workstation Name: MASTER1
=======================================================
=======================================================

Source: Security
Category: Logon/Logoff
Type: Success A
Event ID: 551
User: NT AUTHORITY\SYSTEM

User initiated logoff:
User Name: DRH
Domain: MASTER1
Logon ID: (0x0,0xcb7a)
-----------------------------------------

Source: Security
Category: Logon/Logoff
Type: Success A
Event ID: 538
User: NT AUTHORITY\SYSTEM

User Logoff:
User Name: DRH
Domain: MASTER1
Logon ID: (0x0,0x38C7B)
Logon Type: 2
-----------------------------------------

Source: Security
Category: Logon/Logoff
Type: Success A
Event ID: 528
User: NT AUTHORITY\SYSTEM

Successful Logon:
User Name: DRH
Domain: MASTER1
Logon ID: (0x0,0x38C7B)
Logon Type: 2
Logon Process: User32
Authentication Package: Negotiate
Workstation Name: MASTER1
Logon GUID: {00000000-0000-0000-0000-000000000000}
-----------------------------------------

Source: Service Control Manager
Category: None
Type: Information
Event ID: 7035
User: Master1\DRH

The Remote Access Connection Manager service
was successfully sent a start control.
-----------------------------------------

Source: Service Control Manager
Category: None
Type: Information
Event ID: 7035
User: Master1\DRH

The Fast User Switching Compatibility service
was successfully sent a start control.

Did you check the date on those events to see if they were from before
you renamed your account?