Event Details
Operating System->Microsoft Windows->Built-in logs->Windows 2000-2003->Security Log->Account Logon->EventID 681 - The logon to account: %2 by: %1 from workstation: %3 failed [Win 2000]
EventID 681 - The logon to account: %2 by: %1 from workstation: %3 failed [Win 2000]
A failed logon attempt to  a Windows 2000-based domain controller (DC) is made from a down-level client or through a trust with a down-level domain.

Note:
Refer to the following link in order to see the human-readable descriptions of the codes displayed in the Error Code field.

Find more information about this event on ultimatewindowssecurity.com.

Corresponding events on other OS verions:

Windows 2008
 Sample: 
        Event Type:     Failure Audit
        Event Source:   Security
        Event Category: Account Logon
        Event ID:       681
        Date:           12/14/2009
        Time:           05:31:07
        User:           NT AUTHORITY\SYSTEM
        Computer:       SERVER01
        Description:
        The logon to account: ALebovsky
        by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
        from workstation: SERVER01
        failed. The error code was: 3221225572
Log Type: Windows Event Log
 Uniquely Identified By:
Log Name: Security
Filtering Field Equals to Value
OSVersion Windows 2000
Category Account Logon
Source Security
EventId 681
Field Matching
FieldDescriptionStored inSample Value
DateTime Date/Time of event origination in GMT format. DateTime 10.10.2000 19:00:00
Source Name of an Application or System Service originating the event. Source Security
Type Warning, Information, Error, Success, Failure, etc. Type Success
User Domain\Account name of user/service/computer initiating event. User RESEARCH\Alebovsky
Computer Name of server workstation where event was logged. Computer DC1
EventID Numerical ID of event. Unique within one Event Source. EventId 576
Description The entire unparsed event message. Description Special privileges assigned to new logon.
Log Name The name of the event log (e.g. Application, Security, System, etc.) LogName Security
Category A name for a subclass of events within the same Event Source. Category Logon/Logoff
The logon to account The name of the account logging in InsertionString2
By The name of the authentication package used to validate credentials InsertionString1
From workstation The name of the workstation where the request was sent from InsertionString3
Error code The code for the failure reason. Please find the code descriptions here. InsertionString4
Comments
You must be logged in to comment