• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 744
  • Last Modified:

LOGON Failures

These are on my securty event logs - is someone trying to gain access not authorized?

Event Type:                              Failure Audit
Event Source:      Security
Event Category:      Account Logon
Event ID:                               680
Date:            12/21/2009
Time:            1:51:38 PM
User:            NT AUTHORITY\SYSTEM
Computer:                               XYSRVR1
Description:
Logon attempt by:      MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
 Logon account:      krbtgt
 Source Workstation:      \\NTscan
 Error Code:      0xC0000234
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
0
zaldy
Asked:
zaldy
1 Solution
 
TrackhappyCommented:
Something is trying to logon with an incorrect password. 0xC0000234 indicates an account lockout. Is it possible you have Blackberry or Windows based phones trying to logon, and the user has had a password change?
0
 
LingerLongerCommented:
Or that there's a connection from the host NTSCAN that is using old credentials - maybe a network drive, printer, etc.
Use this blog post to check for cached credentials - http://www.microsoftnow.com/search?q=clear+cached+credentials.
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

Featured Post

Creating Active Directory Users from a Text File

If your organization has a need to mass-create AD user accounts, watch this video to see how its done without the need for scripting or other unnecessary complexities.

Tackle projects and never again get stuck behind a technical roadblock.
Join Now