Event ID : 680 every ten minutes.

Posted on 2007-07-19
Last Modified: 2013-12-04
Dear All,

I'm going through a server log and I've been getting a lot of Event ID : 680s.
The thing I noticed about these messages were that they are exactly 10minutes apart.
eg. 4:15:22       4:25:22        4:35:22  --- and so on.
Does anyone have any idea what this can be?

 Logon account:      IUSR_SERVERNAME7
 Source Workstation:      SERVERNAME7
 Error Code:      0xC0000064

Thank you in advance
Question by:chinguetti
    LVL 31

    Assisted Solution

    by:Toni Uranjek
    Hi chinguetti,

    I believe you are describing Failure event? Does your website use Integrated Windows Authentication and if yes, what is the value of NtAuthenticationProviders in metabase.xml file?

    LVL 7

    Accepted Solution


    This error is basically an user authentication failure.
    It seems that the user IUSR_SERVERNAME7 which is the IIS guest account of workstation SERVERNAME7 is trying to log-in or any other authentication requiered operation with the IIS.
    Your options are:
    1. Allow guest authentication on the IIS
    2. Disable the process that keeps authenticate every 10 minutes
    3. Configure that process to use a valid user credentials
    For more info about your erorr message see:

    Author Comment

    I'm terribly sorry, I was looking at the wrong server!

    toniur: yes, it's indeed a failure event.
    oriziv: great reply, I'll look into it on server7.

    On this server however, the time is randomized, but it's basically always the same three users who show up on the eventvwr. The Error Code being either 0xC0000071 or 0xC0000064 or 0xC000006A
    Logon attempt by:      MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
     Logon account:      username
     Source Workstation:      PC918
     Error Code:      0xC0000071

    For more information, see Help and Support Center at
    LVL 7

    Assisted Solution

    Code 0xC0000071 means that the user's password has been expired, change the user's password and you won't see this message again.

    Code 0xC000006A is a known issue of Win XP. You can disable the welcome screen on the problematic workstation or obtain the latest updates from microsoft.
    In the article I recommanded in my first comment, go to the last post. It deals with this code.

    Featured Post

    Free camera licenses with purchase of My Cloud NAS

    Milestone Arcus software is compatible with thousands of industry-leading cameras for added flexibility. Upon installation on your My Cloud NAS, you will receive two (2) camera licenses already enabled in the software. And for a limited time, get additional camera licenses FREE.

    Join & Write a Comment

    SHARE your personal details only on a NEED to basis. Take CHARGE and SECURE your IDENTITY. How do I then PROTECT myself and stay in charge of my own Personal details (and) - MY own WAY...
    Container Orchestration platforms empower organizations to scale their apps at an exceptional rate. This is the reason numerous innovation-driven companies are moving apps to an appropriated datacenter wide platform that empowers them to scale at a …
    Need more eyes on your posted question? Go ahead and follow the quick steps in this video to learn how to Request Attention to your question. *Log into your Experts Exchange account *Find the question you want to Request Attention for *Go to the e…
    This video gives you a great overview about bandwidth monitoring with SNMP and WMI with our network monitoring solution PRTG Network Monitor ( If you're looking for how to monitor bandwidth using netflow or packet s…

    734 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    22 Experts available now in Live!

    Get 1:1 Help Now