Re: Event 680

Does the Event ID show the name of the source computer assuming type 3 logon
is being attempted? If so that could be a starting point and you could try
to ping the computer name or look at DHCP leases, dns records, or wins
records for the IP address of the computer. --- Steve



"Shahin" <Shahin@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:1CAF08E0-EE19-4F43-922F-3CF751ACC58B@xxxxxxxxxxxxxxxx
Hi,

I have a question regarding security logs, I get a lot of event 680 on one
of my windows 2003 servers, as you know this event has to do with Failure
on
logon, with account Administrator.
Now I would like to know if there is a tool that I can use to get some
info
on this person. Some thing like IP of the person or some thing useful?


Thanks,
Shahin.



.