|
Posted by =?Utf-8?B?dnpyb2dlcnM=?= on October 18, 2005, 8:03 am
If you were Registered and logged in, you could reply and use other advanced thread options
Hello,
The Security Log on one of my 2003 DC's is filling up with a ton of 680
events, coming from the same source workstation, but with all different
variables at the end of the machine name. For example, if the machine name
is server1, the sources vary such as server1x, server1R, server10, server1G,
etc.. The user name indicated in the event is consistent and belongs to
someone in our domain.
The actual event being logged is as follows:
Source: Security
Category: Account Logon
Type: Failure Audit
Event ID: 680
User: NT Authority\System
Computer: "DOMAINCONTROLLER"
Description:
Logon attempt by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon account: "user1"
Source Workstation: "server1X" (** this field varries, as indicated in my
problem description above)
Error Code: 0xC000006A
Does anyone have any idea why this may be occuring, if its malicious, etc.?
Expand AllCollapse All
| 
XML site map