June 16th, 2002 09:37 PM
Local Audit Policy/Security Event Viewer
WindowsXP Pro, Admin Tools, Local Security Policy.
I have changed the settings in the Audit Policy, setting Audit Account Log on Events and Audit Log on Events to report 'failures' in the Security Event Viewer.
Now that I have done that, I have rather alarming failures reporting every 40 mins or so in my Security Event Viewer:
Logon attempt by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon account: Chaz
Source Workstation: HOME-*******
Error Code: 0xC000006A
Failure: EventID 680
Next failure message:
Reason: Unknown user name or bad password
User Name: Chaz
Logon Type: 2
Logon Process: Advapi
Authentication Package: Negotiate
Workstation Name: HOME-********
The same messages then appear for the other username set up in XP.
The system is a stand-alone, connected by Broadband.
The help & support center doesnt provide any information on the first event, and reports that someone is trying to log onto my network with the wrong password in the second event.
I am logged into my account at the time of these multiple events being recorded.
Is this coming from an outside source and what does it mean ?
Can anyone enlighten me if this is a breach taking place, thanks