We help IT Professionals succeed at work.

Event ID : 680 every ten minutes.

Medium Priority
1,476 Views
Last Modified: 2013-12-04
Dear All,

I'm going through a server log and I've been getting a lot of Event ID : 680s.
The thing I noticed about these messages were that they are exactly 10minutes apart.
eg. 4:15:22       4:25:22        4:35:22  --- and so on.
Does anyone have any idea what this can be?

Logon attempt by:      MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
 Logon account:      IUSR_SERVERNAME7
 Source Workstation:      SERVERNAME7
 Error Code:      0xC0000064

Thank you in advance
Comment
Watch Question

Toni UranjekConsultant/Trainer
Commented:
Hi chinguetti,

I believe you are describing Failure event? Does your website use Integrated Windows Authentication and if yes, what is the value of NtAuthenticationProviders in metabase.xml file?

Toni

Not the solution you were looking for? Getting a personalized solution is easy.

Ask the Experts
Commented:
Hi,

This error is basically an user authentication failure.
It seems that the user IUSR_SERVERNAME7 which is the IIS guest account of workstation SERVERNAME7 is trying to log-in or any other authentication requiered operation with the IIS.
Your options are:
1. Allow guest authentication on the IIS
2. Disable the process that keeps authenticate every 10 minutes
3. Configure that process to use a valid user credentials
For more info about your erorr message see:
http://www.eventid.net/display.asp?eventid=680&eventno=2267&source=Security&phase=1

Author

Commented:
I'm terribly sorry, I was looking at the wrong server!

toniur: yes, it's indeed a failure event.
oriziv: great reply, I'll look into it on server7.

On this server however, the time is randomized, but it's basically always the same three users who show up on the eventvwr. The Error Code being either 0xC0000071 or 0xC0000064 or 0xC000006A
Logon attempt by:      MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
 Logon account:      username
 Source Workstation:      PC918
 Error Code:      0xC0000071


For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Commented:
Code 0xC0000071 means that the user's password has been expired, change the user's password and you won't see this message again.

Code 0xC000006A is a known issue of Win XP. You can disable the welcome screen on the problematic workstation or obtain the latest updates from microsoft.
In the article I recommanded in my first comment, go to the last post. It deals with this code.
Access more of Experts Exchange with a free account
Thanks for using Experts Exchange.

Create a free account to continue.

Limited access with a free account allows you to:

  • View three pieces of content (articles, solutions, posts, and videos)
  • Ask the experts questions (counted toward content limit)
  • Customize your dashboard and profile

*This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

OR

Please enter a first name

Please enter a last name

8+ characters (letters, numbers, and a symbol)

By clicking, you agree to the Terms of Use and Privacy Policy.