KnowledgeBase Event Repository

This site is the central interface to the Adiscon Event Repository

  • Details for this entry
  • Eventlog Type:
    Security
    Eventlog Source:
    Security
    Event ID:
    680
    Full Description:
    Identifies the account used for the successful logon attempt. This event also indicates the authentication package used to authenticate the account.
    Parameter Description:
    Account Used for Logon by: %1%n
    Account Name:%n
    %t%2%n
    Workstation: %n
    %t%3%n
    More Informations:
    According to Microsoft

    Cause 1

    A program or service attempted to start with the logon credentials specified in the message, which do not match the credentials of the current user. This message is logged for informational purposes only.

    Resolution

    No user action is required.

    CAUSE 2

    Windows XP attempts a limited logon for each account that is displayed on the Welcome screen to determine whether to prompt the user for a password. An attempted logon is logged for each account displayed.

    Resolution

    To prevent these events from being logged, disable the Welcome screen and use the classic logon screen or turn off auditing of logon events. To turn off auditing in the Microsoft Management Console (MMC) snap-in for Group Policy:

    1. Click Start, click Run, type gpedit.msc, and then click OK.
    2. In the left pane, expand the following items:
    • Local Computer Policy
    • Computer Configuration
    • Windows Settings
    • Security Settings
    • Local Policy
    3. Click Audit Policy.
    4. Double-click Audit Logon Events.
    5. Click to clear the Success and Failure check boxes.
    6. Click OK.
    7. Close the Group Policy window.
    CAUSE 3

    When a user logs off, Windows XP re-reads the user record for updated information to optimize the next logon process. However, Windows ignores the fact that the user is from the local SAM database and instead tries to contact the domain (if the computer is a member of a domain).

    RESOLUTION

    To resolve this problem, obtain the latest service pack for Microsoft Windows XP.

    Search for this Event::
    Search in Knowledge Base  •  Search in this Forum  •  Search on Windows-Expert.com
  • Software Vendor: Microsoft
    Accessed: 7785

Discuss the Event

Discussion for KB Entry 24 - Event ID 680

by knowledgebase on Sat May 31, 2008 9:32 am

This is the discussion thread for the Knowledge Base Entry 24

Eventlog Type: Security
Eventlog Source: Security
Event ID: 680
Link to KB Entry

Short Description:
Identifies the account used for the successful logon attempt. This event also indicates the authentication package used to authenticate the account.
knowledgebase
Forum Bot
 
Posts: 165
Joined: Wed May 28, 2008 10:09 am


About the KnowledgeBase Event Repository

This is a repository of known Windows Events, hopefully together with a description of what it means, when it appears and how to troubleshoot it. The event repository was initially provided as a tool for parser creation but has since evolved. It is now part of the overall knowledgebase in the hope that it provides a useful service to the community. Please add your comments and questions (which we try to answer), as this increases the event repository usefulness for all of us.

Return to

cron