Event ID 680 Audit Failure - concerned about logon account

Hello Experts,
I have a client that is running into an issue with the security logs filling up and users cannot access the computer.  After looking at several of the events I am a bit concerned about the "logon account" .  The names listed keep changing?  Like someone is trying to hack into the computer.

I will attach a couple screen shots for your review.

I would like some help analyzing this issue.

Thanks! Event-Log-Sample.pdf
Who is Participating?
wantabe2Connect With a Mentor Commented:
Here is the site that will help you analyze this:


Take a look at the security failure audit. I saw a hotfix from Microsoft link in there.
Jackie ManConnect With a Mentor Commented:
Obviously, your XP client PC has been compromised and someone is trying to hack into the Server via the xp computer.
ExpetecAuthor Commented:
The solution pointed me in the right direction.
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.