Event ID 680 Audit Failure - concerned about logon account

Posted on 2011-05-05
Last Modified: 2012-05-11
Hello Experts,
I have a client that is running into an issue with the security logs filling up and users cannot access the computer.  After looking at several of the events I am a bit concerned about the "logon account" .  The names listed keep changing?  Like someone is trying to hack into the computer.

I will attach a couple screen shots for your review.

I would like some help analyzing this issue.

Thanks! Event-Log-Sample.pdf
Question by:Expetec
    LVL 15

    Accepted Solution

    Here is the site that will help you analyze this:

    Take a look at the security failure audit. I saw a hotfix from Microsoft link in there.
    LVL 40

    Assisted Solution

    by:Jackie Man
    Obviously, your XP client PC has been compromised and someone is trying to hack into the Server via the xp computer.

    Author Closing Comment

    The solution pointed me in the right direction.

    Featured Post

    6 Surprising Benefits of Threat Intelligence

    All sorts of threat intelligence is available on the web. Intelligence you can learn from, and use to anticipate and prepare for future attacks.

    Join & Write a Comment

    Suggested Solutions

    Sometimes people don't understand why download speed shows differently for Windows than Linux.Specially, this article covers and shows the solution for throughput difference for Windows than a Linux machine. For this, I arranged a test scenario.I…
    In a recent article here at Experts Exchange (, I discussed my nine-month sandbox testing of the Windows 10 Technical Preview, specifically with respect to r…
    Need more eyes on your posted question? Go ahead and follow the quick steps in this video to learn how to Request Attention to your question. *Log into your Experts Exchange account *Find the question you want to Request Attention for *Go to the e…
    Access reports are powerful and flexible. Learn how to create a query and then a grouped report using the wizard. Modify the report design after the wizard is done to make it look better. There will be another video to explain how to put the final p…

    733 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    17 Experts available now in Live!

    Get 1:1 Help Now