Subscribe to How-To Geek

Welcome to the How-To Geek Forums

We encourage you to register on our forums and post any questions you might have. The How-To Geeks monitor this forum and will respond to your question quickly.

How-To Geek Forums » Windows XP

security audit error 529 and 680

(42 posts)
  • Started 1 year ago by tearingmyhairout
  • Latest reply from raphoenix
  • Topic Viewed 1532 times

tearingmyhairout
Posts: 24

Rick if you're still there, I'm back after having to leave this a while as my boy was unwell. After much browsing I've found that you were correct about the 529 and 680 errors being a fault connected with my user page (i.e. logging On with a password). Please read the following note I found. This is for the benefit of anyone else receiving event errors 529 and 680 using Windows XP Home Edition. ;

Why does Windows XP generate so many logon failure events?
I got the question last week, why there are so many logon failure events on Windows XP when it is not domain joined.

The short answer is, by design. (Yes, bad design.)

The longer answer is that the shell team is working around the fact that there is no "tell me if this user account has a blank password" API.

When in a workgroup (not domain joined), Windows XP displays a welcome screen that has little pictures (called "tiles") for each user who is permitted to log on to the computer.

The shell team wanted the experience that when you click on a tile, that you will immediately be logged on if your password is blank (we have good data that a large percentage of home users have blank passwords). They only want you to be prompted for a password if you actually have a password. Fair enough, and it also helps with accessibility for people for whom typing is challenging.

The XP Welcome Screen, when it is initialized each time it is to be displayed, attempts to log on each user for which a tile will be displayed, using a blank password. Users with non-blank passwords will cause failures in this case (other users will cause logon success events followed by logoff success events). [2007-11-21 correction]

The Welcome Screen uses the result of these logon attempts to decide whether to display a password box when you select a user's tile. If the user has a blank password, they will be logged on instead of being prompted for a password.

Why are they logging on the account? Well it turns out to be the easiest way to tell if your password is blank. We don't have a "is your password blank" API- that would be a security disaster- and we would prefer that the shell team not go mucking about in the SAM, retrieving hashes and computing the blank password hash for each account so that it could compare them.

I asked for this behavior to be changed prior to XP's release. Specifically I asked that the blank password check be moved from Welcome screen initialization to tile selection- this would still cause logon failures but many fewer of them. I was declined. I asked for fixes to it in SP1 and SP2 and was declined. At this point we will not be revisiting this "feature"; the Welcome Screen was redesigned to eliminate this problem.

I hope this helps anyone else with these logon 'problems' which it turns out are not really problems at all! Just the Event Viewer eorking overtime it would seem! Also the 615 error I keep getting, I have discovered is just a message that the Internet is not connected at this moment in time. (a problem I seem to get whenever I have cookies.)

I still have a couple of issues with things which probably shouldn't be loading up on startup, as my welcome page loads, then temporarily blacks out for about a second then comes back on again.
Any thoughts on this please? Pam.

Posted 1 year ago #
Top
 
raphoenix
raphoenix
Posts: 5223

tearingmyhairout,

Sorry your Son was sick and hope he is getting better now.
Thank you for confirming my diagnosis concerning your machine's 529 and 680 errors.
Remember I explained there was an error in XP coding which MS never corrected.
As MS has quit officially supporting XP, MS told you correctly they will not be re-visting the the main code.
Thanks for posting the information for others.
You may contact me as you did before.
Post or send a picture of your MSConfig File (Start-up) items.

Kindest Regards,
Rick P.♦ :)

Posted 1 year ago #
Top
 

RSS feed for this topic

Reply

You must log in to post.

Our Friends
Getting Started


About How-To Geek
What Is That Process?
svchost.exe
jusched.exe
dwm.exe
ctfmon.exe
wmpnetwk.exe
wmpnscfg.exe
rundll32.exe
wfcrun32.exe
Ipoint.exe
Itype.exe
Wfica32.exe
Mobsync.exe
conhost.exe
Dpupdchk.exe Adobe_Updater.exe

Copyright © 2006-2009 HowToGeek.com. All Rights Reserved.