?
Solved

Event ID : 680 every ten minutes.

Posted on 2007-07-19
4
Medium Priority
?
1,410 Views
Last Modified: 2013-12-04
Dear All,

I'm going through a server log and I've been getting a lot of Event ID : 680s.
The thing I noticed about these messages were that they are exactly 10minutes apart.
eg. 4:15:22       4:25:22        4:35:22  --- and so on.
Does anyone have any idea what this can be?

Logon attempt by:      MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
 Logon account:      IUSR_SERVERNAME7
 Source Workstation:      SERVERNAME7
 Error Code:      0xC0000064

Thank you in advance
0
Comment
Question by:chinguetti
  • 2
4 Comments
 
LVL 31

Assisted Solution

by:Toni Uranjek
Toni Uranjek earned 75 total points
ID: 19529129
Hi chinguetti,

I believe you are describing Failure event? Does your website use Integrated Windows Authentication and if yes, what is the value of NtAuthenticationProviders in metabase.xml file?

Toni
0
 
LVL 7

Accepted Solution

by:
oriziv earned 300 total points
ID: 19529145
Hi,

This error is basically an user authentication failure.
It seems that the user IUSR_SERVERNAME7 which is the IIS guest account of workstation SERVERNAME7 is trying to log-in or any other authentication requiered operation with the IIS.
Your options are:
1. Allow guest authentication on the IIS
2. Disable the process that keeps authenticate every 10 minutes
3. Configure that process to use a valid user credentials
For more info about your erorr message see:
http://www.eventid.net/display.asp?eventid=680&eventno=2267&source=Security&phase=1
0
 

Author Comment

by:chinguetti
ID: 19529212
I'm terribly sorry, I was looking at the wrong server!

toniur: yes, it's indeed a failure event.
oriziv: great reply, I'll look into it on server7.

On this server however, the time is randomized, but it's basically always the same three users who show up on the eventvwr. The Error Code being either 0xC0000071 or 0xC0000064 or 0xC000006A
Logon attempt by:      MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
 Logon account:      username
 Source Workstation:      PC918
 Error Code:      0xC0000071


For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
0
 
LVL 7

Assisted Solution

by:oriziv
oriziv earned 300 total points
ID: 19529239
Code 0xC0000071 means that the user's password has been expired, change the user's password and you won't see this message again.

Code 0xC000006A is a known issue of Win XP. You can disable the welcome screen on the problematic workstation or obtain the latest updates from microsoft.
In the article I recommanded in my first comment, go to the last post. It deals with this code.
0

Featured Post

Veeam and MySQL: How to Perform Backup & Recovery

MySQL and the MariaDB variant are among the most used databases in Linux environments, and many critical applications support their data on them. Watch this recorded webinar to find out how Veeam Backup & Replication allows you to get consistent backups of MySQL databases.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Background Information Recently I have fixed file server permission issues for one of my client. The client has 1800 users and one Windows Server 2008 R2 domain joined file server with 12 TB of data, 250+ shared folders and the folder structure i…
This article provides a convenient collection of links to Microsoft provided Security Patches for operating systems that have reached their End of Life support cycle. Included operating systems covered by this article are Windows XP,  Windows Server…
this video summaries big data hadoop online training demo (http://onlineitguru.com/big-data-hadoop-online-training-placement.html) , and covers basics in big data hadoop .
As many of you are aware about Scanpst.exe utility which is owned by Microsoft itself to repair inaccessible or damaged PST files, but the question is do you really think Scanpst.exe is capable to repair all sorts of PST related corruption issues?

578 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question