Event ID's 680 and 531 occur every minute.
I have disabled my administrator account and since that time, I keep getting event ID's 680, and 531 repeatedly in my event log every minute. Event ID 531 states that logon process is Advapi, Reason is because account is locked out. The 531 event error references MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 which I can't seem to find any information on. I could use some help with these issues.
March 24th, 2010 11:51pm

Hi, This problem may occur if one service or program on your system use Administrator credential to logon. Please provide more information to find out which service or program is using Administrator account. Also, you can rename the Administrator account instead of disabling it. Please help to collect the information below: 1) Download proper MPS Report tool from the website below. Microsoft Product Support Reportshttp://www.microsoft.com/downloads/details.aspx?FamilyID=CEBF3C7C-7CA5-408F-88B7-F9C79B7306C0&displaylang=en 2) Double-click to run it, if requirement is not met, please follow the wizard to download and install them. After that, click Next, when the "Select the diagnostics you want to run" page appears, select "General", "Server Components", click Next. After collecting all log files, choose "Save the results", choose a folder to save <Computername>MPSReports.cab file, upload the file to Windows Live SkyDrive (http://www.skydrive.live.com/). If you would like other community member to analyze the report, you can paste the link here, if not, you can send the link to tfwst@microsoft.com. Thanks.This posting is provided "AS IS" with no warranties, and confers no rights.
Free Windows Admin Tool Kit Click here and download it now
March 25th, 2010 9:58am

Thanks for the reply. I will have to schedule when I can restart the server since I didn't have powershell on this server yet. I will get that installed and restarted and collect the data and submit it. Thanks
March 25th, 2010 10:54pm

Where can you get access to the file on skydrive? It also says that it can't take a file larger than 50MB and this file is 54MB. I can break it up into 2 files however I still am not sure where it should be placed.
Free Windows Admin Tool Kit Click here and download it now
March 30th, 2010 9:04pm

Hi, Please refer to the following article to troubleshoot this events. Event 531http://www.microsoft.com/technet/support/ee/transform.aspx?ProdName=Windows+Operating+System&ProdVer=5.2&EvtID=531&EvtSrc=Security&LCID=1033 Event ID 680 Source Securityhttp://www.eventid.net/display.asp?eventid=680&eventno=2267&source=Security&phase=1s You can open Event Viewer, choose these event, click Copy and paste the result here for research. Thanks.This posting is provided "AS IS" with no warranties, and confers no rights.
April 1st, 2010 4:59am

Hello, i am getting 80mb + of 680 events when i remote into any of the workstations from a server. These events are not failures, rather a successful event with error code of 0x0. any suggestion on how to turn these events off?
Free Windows Admin Tool Kit Click here and download it now
June 14th, 2010 9:20pm

This topic is archived. No further replies will be accepted.

Other recent topics Other recent topics