Event ID 681

0 pts.
Tags:
Microsoft Windows
Security
Windows 2000 Server
Recently I began noticing Event ID 681 errors in the security logs of our Microsoft ISA Server 2000. These errors are only occuring on 2 specific workstations/user accounts. The event log reads as follows: ----------------------------------------- Date: 3/3/2005 Time: 8:33 Type: Failure User: NT AUTHORITYSYSTEM Computer: SERVERNAME Source: Security Category: Account Logon Event ID: 681 Description: The logon to account: USERNAME by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 from workstation: WORKSTATIONNAME failed. The error code was: 3221225572 ----------------------------------------- This error message is being generated atleast every minute, if not 2 or 3 times a minute and has been occuring since last week sometime. I made several changes on our ISA server last week so that ISA would log user names rather than IP addresses. It seems that these error messages began appearing after that. I find it strange, however, that only 2 users are experiencing this. We have approximately 50 users total and all other accounts seem fine. I have verified that the firewall client is installed and configure properly on these 2 workstations. I have also tried renaming these workstations. The changes made to ISA last week were as follows: >Open SCPFIRE properties>incoming web requests, check the box ?Ask unauthenticated users for identification?. >Access policy>Site & Content rules>Change proxy rule to apply to Accounts:Everyone as opposed to any request (eliminates anonymous access). Any ideas how to eliminate this problem from recurring? Thanks in advance - Wayne
ASKED: March 4, 2005  11:57 AM
UPDATED: March 9, 2005  12:01 PM

Answer Wiki

Thanks. We'll let you know when a new response is added.

Take a look at

http://www.webservertalk.com/archive53-2004-4-191111.html

It looks like the problem may be “Unknown user name or bad password.” So, this begs the question — are these two users in your Everyone group?

Good luck.

Craig Herberg

Discuss This Question: 6  Replies

 
There was an error processing your information. Please try again later.
Thanks. We'll let you know when a new response is added.
Send me notifications when members answer or reply to this question.

REGISTER or login:

Forgot Password?
By submitting you agree to receive email from TechTarget and its partners. If you reside outside of the United States, you consent to having your personal data transferred to and processed in the United States. Privacy
  • Waynebk
    Thanks so much. That appears to have fixed it! I knew it must've been something simple. Thanks again - Wayne
    0 pointsBadges:
    report
  • Waynebk
    My celebration was premature. I just checked the security log again, and the same error messages are resulting. What I changed before was to apply the proxy and users allow rule to Domain Users rather than Everyone. Since all accounts are members of the group domain users automatically, I thought this fixed it. Any other ideas? Wayne
    0 pointsBadges:
    report
  • Stevesz
    from eventid.net, various Q articles that could be of assistance are: Q174074, Q272594, Q273499, Q287626, Q297989, Q321448, Q326985, Q824209, Q837142. Jus tgo to support.microsoft.com and type the digits only in the search box. Steve//
    2,015 pointsBadges:
    report
  • Waynebk
    Thanks for the articles. This one seems to describe what is happenning: http://support.microsoft.com/default.aspx?scid=kb;en-us;837142 However, in order to obtain the hotfix, it looks like it will cost $99. Anyway, thanks for the help. I'll be in contact with Microsoft on this one. Wayne
    0 pointsBadges:
    report
  • DaisyPatch
    Be sure and let us know if the hotfix works. We constantly get a variety of failure to logon events, 681 is one of them. But for all the activity in the event logs, everyone continues to logon just fine. Go figure! DaisyP.
    0 pointsBadges:
    report
  • Waynebk
    Strangely, the hotfix worked on one computer, but on the other two, the same security event error is logged. The hotfix ended up being considered a "grace call" by Microsoft so no charges were incurred. So, I'm still seeking a solution for this error if any has any further suggestions. Since this error does not appear to be effecting anyone's daily performance, I don't feel that it is worth paying MS $245 to solve this for us...It's just an annoyance to me since it keeps filling up the security log. Wayne
    0 pointsBadges:
    report

Forgot Password

No problem! Submit your e-mail address below. We'll send you an e-mail containing your password.

Your password has been sent to:

To follow this tag...

There was an error processing your information. Please try again later.

REGISTER or login:

Forgot Password?
By submitting you agree to receive email from TechTarget and its partners. If you reside outside of the United States, you consent to having your personal data transferred to and processed in the United States. Privacy

Thanks! We'll email you when relevant content is added and updated.

Following