How-To Geek Forums Topic: security audit error 529 and 680

How-To Geek Forums Topic: security audit error 529 and 680 http://www.howtogeek.com/forum/ How-To Geek Forums Topic: security audit error 529 and 680 en Sun, 08 Nov 2009 10:12:31 +0000 raphoenix on "security audit error 529 and 680" http://www.howtogeek.com/forum/topic/security-audit-error-529-and-680/page/3#post-54444 Sat, 25 Oct 2008 00:10:00 +0000 raphoenix 54444@http://www.howtogeek.com/forum/ tearingmyhairout, Sorry your Son was sick and hope he is getting better now. Thank you for confirming my diagnosis concerning your machine's 529 and 680 errors. Remember I explained there was an error in XP coding which MS never corrected. As MS has quit officially supporting XP, MS told you correctly they will not be re-visting the the main code. Thanks for posting the information for others. You may contact me as you did before. Post or send a picture of your MSConfig File (Start-up) items. Kindest Regards, Rick P.♦ :) tearingmyhairout on "security audit error 529 and 680" http://www.howtogeek.com/forum/topic/security-audit-error-529-and-680/page/3#post-54442 Fri, 24 Oct 2008 23:43:36 +0000 tearingmyhairout 54442@http://www.howtogeek.com/forum/ Rick if you're still there, I'm back after having to leave this a while as my boy was unwell. After much browsing I've found that you were correct about the 529 and 680 errors being a fault connected with my user page (i.e. logging On with a password). Please read the following note I found. This is for the benefit of anyone else receiving event errors 529 and 680 using Windows XP Home Edition. ; Why does Windows XP generate so many logon failure events? I got the question last week, why there are so many logon failure events on Windows XP when it is not domain joined. The short answer is, by design. (Yes, bad design.) The longer answer is that the shell team is working around the fact that there is no "tell me if this user account has a blank password" API. When in a workgroup (not domain joined), Windows XP displays a welcome screen that has little pictures (called "tiles") for each user who is permitted to log on to the computer. The shell team wanted the experience that when you click on a tile, that you will immediately be logged on if your password is blank (we have good data that a large percentage of home users have blank passwords). They only want you to be prompted for a password if you actually have a password. Fair enough, and it also helps with accessibility for people for whom typing is challenging. The XP Welcome Screen, when it is initialized each time it is to be displayed, attempts to log on each user for which a tile will be displayed, using a blank password. Users with non-blank passwords will cause failures in this case (other users will cause logon success events followed by logoff success events). [2007-11-21 correction] The Welcome Screen uses the result of these logon attempts to decide whether to display a password box when you select a user's tile. If the user has a blank password, they will be logged on instead of being prompted for a password. Why are they logging on the account? Well it turns out to be the easiest way to tell if your password is blank. We don't have a "is your password blank" API- that would be a security disaster- and we would prefer that the shell team not go mucking about in the SAM, retrieving hashes and computing the blank password hash for each account so that it could compare them. I asked for this behavior to be changed prior to XP's release. Specifically I asked that the blank password check be moved from Welcome screen initialization to tile selection- this would still cause logon failures but many fewer of them. I was declined. I asked for fixes to it in SP1 and SP2 and was declined. At this point we will not be revisiting this "feature"; the Welcome Screen was redesigned to eliminate this problem. I hope this helps anyone else with these logon 'problems' which it turns out are not really problems at all! Just the Event Viewer eorking overtime it would seem! Also the 615 error I keep getting, I have discovered is just a message that the Internet is not connected at this moment in time. (a problem I seem to get whenever I have cookies.) I still have a couple of issues with things which probably shouldn't be loading up on startup, as my welcome page loads, then temporarily blacks out for about a second then comes back on again. Any thoughts on this please? Pam. raphoenix on "security audit error 529 and 680" http://www.howtogeek.com/forum/topic/security-audit-error-529-and-680/page/2#post-52300 Mon, 13 Oct 2008 13:39:34 +0000 raphoenix 52300@http://www.howtogeek.com/forum/ Picture remove by raphoenix 10/16/2008 to conserve bandwidth. raphoenix on "security audit error 529 and 680" http://www.howtogeek.com/forum/topic/security-audit-error-529-and-680/page/2#post-52249 Mon, 13 Oct 2008 00:38:58 +0000 raphoenix 52249@http://www.howtogeek.com/forum/ Picture removed by raphoenix 10/16/2008 to conserve bandwidth. raphoenix on "security audit error 529 and 680" http://www.howtogeek.com/forum/topic/security-audit-error-529-and-680/page/2#post-52179 Sun, 12 Oct 2008 19:26:57 +0000 raphoenix 52179@http://www.howtogeek.com/forum/ tearingmyhairout, This appears to be a Major Problem as both 680 and 615 Security Events are mentioned in the MS Article. (Failure Events Are Logged When the Welcome Screen Is Enabled) <a href="http://support.microsoft.com/kb/305822/en-us" rel="nofollow">http://support.microsoft.com/kb/305822/en-us</a> Kindest Regards, Rick P.♦ :) tearingmyhairout on "security audit error 529 and 680" http://www.howtogeek.com/forum/topic/security-audit-error-529-and-680/page/2#post-52176 Sun, 12 Oct 2008 19:21:33 +0000 tearingmyhairout 52176@http://www.howtogeek.com/forum/ Rick, sorry just read this since I emailed you. The two event errors 529 and 680 aren't old (please look at the times in the log), they occur every time I log onto my page even after it has only been on screensaver. I don't see why 'fast user swithching' should cause any problems, it never has done before. I don't believe Bullguard is at fault. raphoenix on "security audit error 529 and 680" http://www.howtogeek.com/forum/topic/security-audit-error-529-and-680/page/2#post-52161 Sun, 12 Oct 2008 17:50:11 +0000 raphoenix 52161@http://www.howtogeek.com/forum/ tearingmyhairout, Are the EVENT SECURITY LOG items increasing OR they are the (SAME) (2) OLD items that were in log originally ?? There is a fix to clear them but prefer just to leave them in log if they are OLD. Recommend NOT using the picture (Fast user switching) screen to log-in. Old script error MS never fixed sometimes occurs. Change to normal Log-In screen. Also, don't mess around in Registry. Hard to help from here if something goes wrong. Remember, I know nothing concerning (Microsoft BullGuard Main Service) which is running on your machine. Kindest Regards, Rick P. ♥ :) tearingmyhairout on "security audit error 529 and 680" http://www.howtogeek.com/forum/topic/security-audit-error-529-and-680/page/2#post-52147 Sun, 12 Oct 2008 16:36:18 +0000 tearingmyhairout 52147@http://www.howtogeek.com/forum/ Thanks for your help Rick. The DCOM 10005 errors have cleared up in the System log, but, my security log is still showing the same log on/off errors as it has all along, and my screen, which was temporarily flashing off for a split second when I logged onto my page, has just done it in between browsing. I feel I am beginning to get out of my depth tampering with the registry. raphoenix on "security audit error 529 and 680" http://www.howtogeek.com/forum/topic/security-audit-error-529-and-680/page/2#post-52145 Sun, 12 Oct 2008 15:23:12 +0000 raphoenix 52145@http://www.howtogeek.com/forum/ Picture removed by raphoenix 10/16/2008 to conserve bandwidth. raphoenix on "security audit error 529 and 680" http://www.howtogeek.com/forum/topic/security-audit-error-529-and-680/page/2#post-52144 Sun, 12 Oct 2008 15:22:42 +0000 raphoenix 52144@http://www.howtogeek.com/forum/ Picture removed by raphoenix 10/16/2008 to conserve bandwidth. raphoenix on "security audit error 529 and 680" http://www.howtogeek.com/forum/topic/security-audit-error-529-and-680/page/2#post-52143 Sun, 12 Oct 2008 15:22:10 +0000 raphoenix 52143@http://www.howtogeek.com/forum/ Picture removed by raphoenix 10/16/2008 to conserve bandwidth. tearingmyhairout on "security audit error 529 and 680" http://www.howtogeek.com/forum/topic/security-audit-error-529-and-680/page/2#post-52044 Sat, 11 Oct 2008 23:52:57 +0000 tearingmyhairout 52044@http://www.howtogeek.com/forum/ Thanks Rick. Reply sent. raphoenix on "security audit error 529 and 680" http://www.howtogeek.com/forum/topic/security-audit-error-529-and-680/page/2#post-52038 Sat, 11 Oct 2008 23:11:22 +0000 raphoenix 52038@http://www.howtogeek.com/forum/ Services Template Info Sent. Kindest Regards, Rick P. ♥ :) tearingmyhairout on "security audit error 529 and 680" http://www.howtogeek.com/forum/topic/security-audit-error-529-and-680/page/2#post-52034 Sat, 11 Oct 2008 22:30:47 +0000 tearingmyhairout 52034@http://www.howtogeek.com/forum/ Thanks for that Scott. Anyone out there know what I should be doing plesae? Scott on "security audit error 529 and 680" http://www.howtogeek.com/forum/topic/security-audit-error-529-and-680/page/2#post-51883 Sat, 11 Oct 2008 04:40:15 +0000 Scott 51883@http://www.howtogeek.com/forum/ <a href="http://imageshack.us"><img src="http://img509.imageshack.us/img509/1674/1serviceop2.jpg"></a> <a href="http://imageshack.us"><img src="http://img390.imageshack.us/img390/3866/2servicesu6.jpg"></a> <a href="http://imageshack.us"><img src="http://img390.imageshack.us/img390/9458/3servicerp9.jpg"></a> <a href="http://imageshack.us"><img src="http://img381.imageshack.us/img381/9397/4servicepn4.jpg"></a> <a href="http://imageshack.us"><img src="http://img509.imageshack.us/img509/6070/5serviceze2.jpg"></a> <a href="http://imageshack.us"><img src="http://img171.imageshack.us/img171/1142/6servicebu4.jpg"></a> <a href="http://imageshack.us"><img src="http://img126.imageshack.us/img126/3695/7servicevd2.jpg"></a> <a href="http://imageshack.us"><img src="http://img381.imageshack.us/img381/2769/8servicekb6.jpg"></a> tearingmyhairout on "security audit error 529 and 680" http://www.howtogeek.com/forum/topic/security-audit-error-529-and-680/page/2#post-51838 Sat, 11 Oct 2008 00:19:28 +0000 tearingmyhairout 51838@http://www.howtogeek.com/forum/ P.S. I forgot to add that when I first had these problems, I couldn't restore my registry to its original state because whatever caused these problems also wiped out all of my System Restore points. tearingmyhairout on "security audit error 529 and 680" http://www.howtogeek.com/forum/topic/security-audit-error-529-and-680/page/2#post-51837 Sat, 11 Oct 2008 00:13:53 +0000 tearingmyhairout 51837@http://www.howtogeek.com/forum/ Sorry, perhaps I didn't explain properly. The printer issue was just in response to you asking me if everything was running o.k. apart from the errors in my System Log. Don't worry about the printer, I will sort that out later. (maybe when I've fixed the other issues, the printer will resolve itself!) The reason for printing the System log, was to see if anyone could throw light on why I keep getting error messages 529 and 680 whenever I log on/off. Also I sometimes get error 615. Please also print my Services Log which I originally sent to Raphoenix, who then passed it on to you (Scott), Which services do I need to enable/disable in my Services to stop these error messages? I think that's all I need. Scott on "security audit error 529 and 680" http://www.howtogeek.com/forum/topic/security-audit-error-529-and-680/page/2#post-51829 Fri, 10 Oct 2008 22:49:06 +0000 Scott 51829@http://www.howtogeek.com/forum/ <a href="http://imageshack.us"><img src="http://img337.imageshack.us/img337/5517/capturevn7.jpg"></a> This is part of Pam's event viewer log. Her issue is that her printer won't print color. Not sure this is an XP specific issue, hardware or software related. We'll leave it here in this forum for now. tearingmyhairout on "security audit error 529 and 680" http://www.howtogeek.com/forum/topic/security-audit-error-529-and-680/page/2#post-51828 Fri, 10 Oct 2008 22:13:19 +0000 tearingmyhairout 51828@http://www.howtogeek.com/forum/ Have you received my log? Pam. Scott on "security audit error 529 and 680" http://www.howtogeek.com/forum/topic/security-audit-error-529-and-680/page/2#post-51820 Fri, 10 Oct 2008 20:50:41 +0000 Scott 51820@http://www.howtogeek.com/forum/ Please try <a href="mailto:scott@howtogeek.com">scott@howtogeek.com</a> , with the caveat that I will likely just post your log here so others can view and offer assistance.