Description of Security Event 681 (273499)

SUMMARY

When you try to audit logon events on a Windows 2000-based domain controller (DC) and a failed logon attempt is made from a down-level client or through a trust with a down-level domain, a "Failure Audit" event with an event ID of 681 may be logged in the Security Event log. Note that the source of the event is "Security". This article contains descriptions of the various error codes that are listed in the event description.

MORE INFORMATION

Note that the error codes in the Event Log message are in decimal form, but they are actually hexadecimal values. You can translate the values from decimal to hexadecimal by using the Calculator tool in Windows 2000, or by viewing the following table. The most common error codes you may receive are defined in the following table:

Error Code	Hexadecimal Value Error Code	Cause
3221225572	C0000064	User logon with misspelled or bad user account
3221225578	C000006A	User logon with misspelled or bad password
3221225581	C000006D	User logon has incorrect user name
3221225583	C000006F	User logon outside authorized hours
3221225584	C0000070	User logon from unauthorized workstation
3221225585	C0000071	User logon with expired password
3221225586	C0000072	User logon to account disabled by administrator
3221225875	C0000193	User logon with expired account
3221226020	C0000224	User logon with "Change Password at Next Logon" flagged
3221226036	C0000234	User logon with account locked