0xC000006A - Event ID: 680

[rottendumpling]

Recently I set up my workstation to audit successful or failed logon events. I rebooted to test it out and found out that a failure audit is recorded alongside a success audit. How can both a failure and success be recorded at the same time every time I logon?

Edited June 2, 2007 by rottendumpling

[cluberti]

If you're using XP in a non-Domain environment, this is actually normal behavior. In this scenario, XP tries to do a limited logon of all accounts that are listed on the welcome screen, to see which one(s) require a password, and which do not. If you use the "classic" logon, this event won't be logged (either disable the welcome screen or join a domain), or don't audit failure for logon events.

This is described in KB305822, and it looks like it won't be until SP3 at the earliest that it's resolved (although it doesn't happen on Vista or Server 2008, as far as I can tell).

[rottendumpling]

Ah I see, that makes sense. Thanks for the fast and detailed response!