[Curley_Boy]

My event logs keep reporting these events, can anyone shed any light on this plz?

Catagory: Account Logon Event ID: 680
User: NT AUTHORITY\SYSTEM

Logon attempt by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon account: ****
Source Workstation: ****
Error Code: 0xC000006A

Catagory: Logon/Log off Event ID: 529
User: NT AUTHORITY\SYSTEM

Logon Failure:
Reason: Unknown user name or bad password
User Name: ****
Domain: ****
Logon Type: 2
Logon Process: Advapi
Authentication Package: Negotiate
Workstation Name: ****

The above events appear 4 times each logon... the system has no other longon probs though, Just these entries.

[Four and Twenty]

you were disabling services right?
did you write down the stuff you changed?

[adamvjackson]

Quote:

Catagory: Account Logon Event ID: 680
User: NT AUTHORITY\SYSTEM

Logon attempt by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon account: ****
Source Workstation: ****
Error Code: 0xC000006A

Catagory: Logon/Log off Event ID: 529
User: NT AUTHORITY\SYSTEM

The above 3 show up on the event logs in .Net Advanced Server, too. I always assumed that this was the 'system' logging on, as even when you log in as local admin, the machine is also logging in as 'system'. The authentication package.. not sure on this one, but as I said, on a clean, unaltered install of .Net AS this is there, so I assume it is needed.

[Curley_Boy]

I set up auditing for logon/log off events...

As far as I remember it showed up from the start ie clean install (so not likely to be hackers, ditto for Win2000).

I've traced it down (I think) to my firewall software which blocks alot of stuff. Not too worry as I clean out the event logs once a week anyhow.