Avatar of andyrob-davis
andyrob-davis

asked on 

Failure Audit Event ID's 529 672 and 680 generated.

Windows 2003 server SP2 Domain Controller generates failure audits with the event ID's of 529 672 and 680. I have read and tried techsoeasy's solution of using netdom.exe to rename the machine account in AD but the events are still being generated at least once an hour. Text of the events is the same as that already supplied by previous questioners but I've included anyway. The domain administrator account  is not administrator obviously. Has anyone else managed to find a way of fixing this problem.


Event Type:      Failure Audit
Event Source:      Security
Event Category:      Account Logon
Event ID:      672
Date:            22/07/2008
Time:            10:43:10
User:            NT AUTHORITY\SYSTEM
Computer:      FHC-2K3
Description:
Authentication Ticket Request:
       User Name:            administrator
       Supplied Realm Name:      FHC
       User ID:                  -
       Service Name:            krbtgt/FHC
       Service ID:            -
       Ticket Options:            0x40810010
       Result Code:            0x6
       Ticket Encryption Type:      -
       Pre-Authentication Type:      -
       Client Address:            127.0.0.1
       Certificate Issuer Name:      
       Certificate Serial Number:      
       Certificate Thumbprint:      


For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:      Failure Audit
Event Source:      Security
Event Category:      Logon/Logoff
Event ID:      529
Date:            22/07/2008
Time:            09:35:26
User:            NT AUTHORITY\SYSTEM
Computer:      FHC-2K3
Description:
Logon Failure:
       Reason:            Unknown user name or bad password
       User Name:      administrator
       Domain:            FHC
       Logon Type:      3
       Logon Process:      NtLmSsp
       Authentication Package:      NTLM
       Workstation Name:      FHC-2K3
       Caller User Name:      -
       Caller Domain:      -
       Caller Logon ID:      -
       Caller Process ID:      -
       Transited Services:      -
       Source Network Address:      -
       Source Port:      -


For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:      Failure Audit
Event Source:      Security
Event Category:      Account Logon
Event ID:      680
Date:            22/07/2008
Time:            09:35:26
User:            NT AUTHORITY\SYSTEM
Computer:      FHC-2K3
Description:
Logon attempt by:      MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
 Logon account:      administrator
 Source Workstation:      FHC-2K3
 Error Code:      0xC0000064


For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.


 
Microsoft Server OS

Avatar of undefined
Last Comment
andyrob-davis
Avatar of Paranormastic
Paranormastic
Flag of United States of America image

Did a little looking around one on this one.  One suggestion is that there can be problems caused by Vista connecting to the server - the suggestion is to upgrate to SP2 on your server (which it sounds like you already did) and try this patch:
http://www.microsoft.com/downloads/details.aspx?FamilyId=062E954C-FDEC-45AF-A09C-5A05B8F010A5&displaylang=en
Avatar of andyrob-davis
andyrob-davis

ASKER

Hi
I have no Vista computers on the network apart from occasional visitors (thank god!). The patch you suggested is already installed from the looks of it it is included in SP2.

Andy
ASKER CERTIFIED SOLUTION
Avatar of andyrob-davis
andyrob-davis

Blurred text
THIS SOLUTION IS ONLY AVAILABLE TO MEMBERS.
View this solution by signing up for a free trial.
Members can start a 7-Day free trial and enjoy unlimited access to the platform.
See Pricing Options
Start Free Trial
Microsoft Server OS
Microsoft Server OS

The Microsoft Server topic includes all of the legacy versions of the operating system, including the Windows NT 3.1, NT 3.5, NT 4.0 and Windows 2000 and Windows Home Server versions.

59K
Questions
--
Followers
--
Top Experts
Get a personalized solution from industry experts
Ask the experts
Read over 600 more reviews

TRUSTED BY

IBM logoIntel logoMicrosoft logoUbisoft logoSAP logo
Qualcomm logoCitrix Systems logoWorkday logoErnst & Young logo
High performer badgeUsers love us badge
LinkedIn logoFacebook logoX logoInstagram logoTikTok logoYouTube logo