Learn how to a build a cloud-first strategyRegister Now

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 736
  • Last Modified:

LOGON Failures

These are on my securty event logs - is someone trying to gain access not authorized?

Event Type:                              Failure Audit
Event Source:      Security
Event Category:      Account Logon
Event ID:                               680
Date:            12/21/2009
Time:            1:51:38 PM
User:            NT AUTHORITY\SYSTEM
Computer:                               XYSRVR1
Description:
Logon attempt by:      MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
 Logon account:      krbtgt
 Source Workstation:      \\NTscan
 Error Code:      0xC0000234
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
0
zaldy
Asked:
zaldy
1 Solution
 
TrackhappyCommented:
Something is trying to logon with an incorrect password. 0xC0000234 indicates an account lockout. Is it possible you have Blackberry or Windows based phones trying to logon, and the user has had a password change?
0
 
LingerLongerCommented:
Or that there's a connection from the host NTSCAN that is using old credentials - maybe a network drive, printer, etc.
Use this blog post to check for cached credentials - http://www.microsoftnow.com/search?q=clear+cached+credentials.
0

Featured Post

Free Tool: Path Explorer

An intuitive utility to help find the CSS path to UI elements on a webpage. These paths are used frequently in a variety of front-end development and QA automation tasks.

One of a set of tools we're offering as a way of saying thank you for being a part of the community.

Tackle projects and never again get stuck behind a technical roadblock.
Join Now