Consulta Sobre error

San Eventid (www.eventid.net) dice:

http://www.eventid.net/display.asp?...e=Security

Event ID: 681
Source Security
Type Failure Audit
Description The logon to account: <account name>
by: <authentication package>
from workstation: <workstation name>
failed. The error code was: <error code>
Comments Adrian Grigorof
This event indicates a failed logon attempt. A decimal error code is
included in the event (i.e. 3221225578) that translates to the cause of the
failure. See Q273499 for what different codes mean.

Ionut Marin (Last update 10/7/2003):
See Q824209 on how to use the EventCombMT utility to search the event
logs of multiple computers for account lockouts.

From a newsgroup post, from a Microsoft Engineer: "Some rules of
thumb:
1) Ignore single bad password events. If it only happens once, it's
probably not worth investigating.
2) When examining logon failures, go to the workstation that is
generating the bad requests and look for something there, particularly a
service.
3) Don't assume it's a hacker until you rule out everything else".

From a newsgroup post, from a Microsoft Engineer:
"529 is a failure event (bad username or password) in the
"Logon/Logoff" category of audits - it is generated when the creation of a
logon session (and token) fails, on the machine where access was attempted.
681 is a failure event (account logon failure) in the "Account Logon"
category of audits - it's generated when a security package authenticates
your credentials. This occurs on the machine authoritative for the account
being used - the local machine in the case of local accounts or a Domain
Controller in the case of domain accounts. There is no corresponding logoff
event for Account Logon events.
When you log on to a domain, it's typical to see both kinds of events
on the DC and the first kind (logon/logoff) on the workstation. The DC
generates an account logon event when it validates your credentials. The
workstation generates a logon/logoff event when it receives the DC's
response and allows you to log on. The DC then generates one or more
logon/logoff events as your workstation connects to it to download your
login scripts, user profile, etc".

Marcel Schoenenberger (Last update 7/31/2003):
If the user is the IWAM account then this event may be caused by
mismatching passwords between the IIS metabase and the user database. See
Q297989.

Adrian Florin Moisei (Last update 5/19/2003):
This event may be also caused by IIS Kerberos-related issues. See
Q326985.
Links Q174074 , Q272594 , Q273499 , Q326985 , Q297989 , Q824209 ,
Online Analysis of Security Event Log




































saludos

aaa

"Gerard" escribió en el mensaje
news:09bf01c3d514$dd988b90$
Gente alguien me podria decir que significa este error.
Esta en el visor de sucesos, en la parte Registro de
serguridad.

Tipo de suceso: Errores
Origen del suceso: Security
Categoría del suceso: Inicio de sesión de la cuenta
Id. del suceso: 681
Fecha: 07/01/2004
Hora: 04:32:45 a.m.
Usuario: NT AUTHORITY\SYSTEM
Equipo: S126718
Descripción:
Error del inicio de sesión a la cuenta: CLAUDIO RIVERA
por: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
desde la estación de trabajo: \\GRANEL
El código de error es: 3221225572