事件查看器中有关安全性错误代码为529的失败审核

今天不知道为什么，突然想起来要看看自己电脑上的事件查看器。没有想到的是，在安全性一栏中有很多失败审核。

典型的错误代码有680，529，还有一个615.

先说前面两个。经过一段时间查找。最能说明该问题的文章是http://support.microsoft.com/kb/305822/en-us
两个失败记录之后跟随一个登录成功的记录。

Event Type: Failure Audit
Event Source: Security
Event Category: Logon/Logoff
Event ID: 529
Date: date
Time: time
User: NT AUTHORITY\SYSTEM
Computer: %computer name%
Description:
Logon Failure:
Reason: Unknown user name or bad password
User Name: %user name%
Domain: %computer name%
Logon Type: 2
Logon Process: Advapi
Authentication Package: Negotiate
Workstation Name: %computer name%

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.


Event Type: Failure Audit
Event Source: Security
Event Category: Account Logon
Event ID: 680
Date: date
Time: time
User: NT AUTHORITY\SYSTEM
Computer: %computer name%
Description:
Logon attempt by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon account: %user name%
Source Workstation: %computer name%
Error Code: 0xC000006A

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.


Event Type: Success Audit
Event Source: Security
Event Category: Account Logon
Event ID: 680
Date: date
Time: time
User: NT AUTHORITY\SYSTEM
Computer: %computer name%
Description:
Logon attempt by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon account: %user name%
Source Workstation: %computer name%
Error Code: 0x0

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

文章中有简短准确的描述：

SYMPTOMS

With the welcome screen and logon/logoff and/or account logon success and failure auditing are enabled, pairs of Logon/Logoff failure or Account Logon failure audits with successful logon audit entries are added to the computer security log.

其中，关键点是两个：1. 欢迎屏幕；2. 登录审计
相应的解决办法就是：1. 去掉欢迎屏幕形式的登录方式；2. 去掉登录审计。

很明显的，后一种方法不可取，毕竟这是一个重要的安全特征。所以，只好去掉欢迎屏幕了。具体的方法请参照该文章。

注：经过尝试，发现只去掉欢迎屏幕登录方式仿佛是不行的……无语。我用的是windows XP HOME EDITION，没有组策略可以使用。所以，只能看着该错误消息出现在我的事件查看器中了。

至于原因，是因为XP对出现在欢迎屏幕上的每一个用户都要作有限次的登录尝试，用以决定是否需要提示用户输入密码。失败的记录就这样被登记在事件查看器中了。