Event Details
Operating System->Microsoft Windows->Built-in logs->Windows 2000-2003->Security Log->Account Logon->EventID 680 - Account Used for Logon by: %1 [Win 2000]
EventID 680 - Account Used for Logon by: %1 [Win 2000]
A set of credentials was passed to the authentication system on this computer either by a local process or by a remote process or user.

Success or failure is displayed in the message. If this event indicates success, then the credentials presented were valid. The error code is 0x0 for success messages. For failure messages, the user field in the message header displays NT AUTHORITY\SYSTEM, and an NTStatus code is displayed. 

Note: 
Refer to the following link in order to see the human-readable descriptions of the codes displayed in the Error Code field.

Find more information about this event on ultimatewindowssecurity.com.

Corresponding events on other OS versions:

Windows 2008


Related events:

 Sample: 
        Event Type:     Success Audit
        Event Source:   Security
        Event Category: Account Logon
        Event ID:       680
        Date:           12/14/2009
        Time:           05:31:26
        User:           NT AUTHORITY\SYSTEM
        Computer:       SERVER01
        Description:
        Account Used for Logon by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
        Account Name:
        administrator
        Workstation:
        SERVER01
Log Type: Windows Event Log
 Uniquely Identified By:
Log Name: Security
Filtering Field Equals to Value
OSVersion Windows 2000
Category Account Logon
Source Security
EventId 680
Field Matching
FieldDescriptionStored inSample Value
DateTime Date/Time of event origination in GMT format. DateTime 10.10.2000 19:00:00
Source Name of an Application or System Service originating the event. Source Security
Type Warning, Information, Error, Success, Failure, etc. Type Success
User Domain\Account name of user/service/computer initiating event. User RESEARCH\Alebovsky
Computer Name of server workstation where event was logged. Computer DC1
EventID Numerical ID of event. Unique within one Event Source. EventId 576
Description The entire unparsed event message. Description Special privileges assigned to new logon.
Log Name The name of the event log (e.g. Application, Security, System, etc.) LogName Security
Category A name for a subclass of events within the same Event Source. Category Logon/Logoff
Account used for logon by Identifies the authentication package that processed the authentication request InsertionString1
Account Name Account logging in InsertionString2
Workstation Name Client computer's name from which the user initiated the logon InsertionString3
Comments
You must be logged in to comment