Event Id 680



Event Id: 680: Source: Security. Event Information: According to Microsoft: Cause 1: A program or service attempted to start with the logon credentials specified. It is replaced by 680 type Failure Audit. In Windows Server 2003 Microsoft eliminated event ID 681 and instead uses event ID 680 for both successful and failed NTLM authentication attempts. So on Windows Server 2003 don't look for event ID 681 and be sure to take into account the success/failure status of occurrences of event ID 680.

  1. Event Id 6801 Adsync
  2. Event Id 6803
  3. Event Id 6803 Adsync

event id 529 and 680

Nov 24, 2011 04:42 PM|twisterice|LINK

Hello,

i'm very frustrated because i've not still found a fix to my issue:

i've win2003 r2 standard with a website called web1 and a virtual directory called vir1...now, on the property of vir1 i've changed the authentication to basic because a my customer needs to connect to this app via web services using a local user (user1) that i've created on this web server. So in this property of vir1, instead of using IUSR_SERVER i've used this local user.

This portal has worked fine for a long time but recently for unknown reason every time inside my web app (built in .net) i try to use the download function that point to download a file inside vir1, it show me 401.1 error telling me that i've no rights to view or bad password.

Event

Infact in the event viewer i receive event id 529 and 680...WHAT'S WRONG? i've tried lot of things such as cscript adsutil.vbs set w3svc/indetifier/root/vir1/NTAuthenticationProviders 'negotiate,NTLM' or simply 'NTLM' but nothing to do....HELP!!!!

Event680

Event Type: Failure Audit
Event Source: Security
Event Category: Logon/Logoff
Event ID: 529
Date: 24/11/2011
Time: 22.01.45
User: NT AUTHORITYSYSTEM
Computer: WEB1
Description:
Logon Failure:
Reason: Unknown user name or bad password
User Name: USER1
Domain: WEB1
Logon Type: 8
Logon Process: Advapi
Authentication Package: Negotiate
Workstation Name: WEB1
Caller User Name: NETWORK SERVICE
Caller Domain: NT AUTHORITY
Caller Logon ID: (0x0,0x3E4)
Caller Process ID: 144
Transited Services: -
Source Network Address: XX.XX.XX.XX
Source Port: 55707

Event Id 6801 Adsync

Event Id 680

and 680 event

Event Id 6803

Event Type: Failure Audit
Event Source: Security
Event Category: Account Logon
Event ID: 680
Date: 24/11/2011
Time: 22.01.45
User: NT AUTHORITYSYSTEM
Computer: WEB1
Description:
Logon attempt by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon account: USER1
Source Workstation: WEB1
Error Code: 0xC000006A

Event Id 6803 Adsync






Comments are closed.