Event Details
User Activity->Logons->Failed Logons->Windows 2000-2003->EventID 680 - Logon attempt by: %1 [Win 2003 / XP]
EventID 680 - Logon attempt by: %1 [Win 2003 / XP]
 Sample: 
        Event Type:     Success Audit
        Event Source:   Security
        Event Category: Account Logon
        Event ID:       680
        Date:           12/14/2009
        Time:           06:59:09
        User:           SERVER\Administrator
        Computer:       SERVER
        Description:
        Logon attempt by:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
        Logon account:	administrator
        Source Workstation:	SERVER
        Error Code:	0x0
Log Type: Windows Event Log
 Uniquely Identified By:
Log Name: Security
Filtering Field Equals to Value
OSVersion Windows 2003
Windows XP
Category Account Logon
Source Security
EventId 680
Type Failure Audit
Field Matching
FieldDescriptionStored inSample Value
When At what date and time a user activity originated in the system. DateTime 1/1/2000
Who Account or user name under which the activity occured. Logon Account
What The type of activity occurred (e.g. Logon, Password Changed, etc.) "NTLM Authentication" NTLM Authentication
Where The name of the workstation/server where the activity was logged. Computer 10.10.10.10
Where From The name of the workstation/server where the activity was initiated from. Source Workstation SERVER
Severity Specify the seriousness of the event. "High" High
WhoDomain -
WhereDomain -
Result Successful or Failed. "Failed" Failed
Failure Reason Failure Reason - Bad user name or password, not enough privileges, etc. Error Code 0x0
Comments
You must be logged in to comment