Event ID: 681

From: Brenda (bdonals@martorifarms.com)
Date: 02/20/03 

From: "Brenda" <bdonals@martorifarms.com>
Date: Thu, 20 Feb 2003 14:43:38 -0800

I see this quite often in my event log and feel that
someone is attempting to get into my servers/network.

When this happens, I notice that the account names are our
entire users accounts. Like this one started at 6:44:19
and had about 120 event ids 681 and 529. Each with the
different logon accounts.

The logon to account: administrator
 by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
 from workstation: AMSTERDA-R50NAC
 failed. The error code was: 3221225578

They are all failed, but should I be concerned and is
there a way that I can track this guy/gal down? The
workstation changes not each time but each day. This
person has been attempting this for the past 4 weeks, with
no luck. All have failed.

Thanks

Relevant Pages

  • Re: Unexplained User Account Deletion
    ... event log is at the heart of the problem in light of the fact that the ... GUID' statement literally, however I am referring to the DEL: ... Category: Account Mgmt ... Target Account Name: User1 ...
    (microsoft.public.windows.server.active_directory)
  • Re: Unexplained User Account Deletion
    ... I don't believe it was the event log obviously and I am not really of the opinion it is ADUC either. ... Joe Richards Microsoft MVP Windows Server Directory Services ... Category: Account Mgmt ... Target Account Name: User1 ...
    (microsoft.public.windows.server.active_directory)
  • Server Application Unavailable
    ... I'd actually likely be able to figure this out on my own if the administrator note were correct, but I can't find anything in the event log about the issue either. ... I see nothing about username/password in the processModel Section of that file, ... correctly installed and that the ACLs on the installation ... directory allow access to the configured account. ...
    (microsoft.public.dotnet.framework.aspnet)
  • Re: Help Me Resolve Event Errors
    ... > The problem is that each time she logs on, the Event Log records ... > Component: Security Event Log ... > Logon Process: %4 ... > account or a valid user account but with an incorrect password. ...
    (microsoft.public.windowsxp.general)
  • Re: Computer Missing from AD
    ... Well, now that you've checked group membership, I assume we should wait and ... then look in the event log when/if any new computer account will be deleted. ... >>> 'Missing Computers Object in AD'. ...
    (microsoft.public.windows.server.active_directory)