More on Event ID: 681, error code 3221225594

  • Thread starter Thread starter Alan J. McFarlane
  • Start date Start date
A

Alan J. McFarlane

Hi

I previous posted asking what this Event Log entry (for detail, see first
log entry below) represented and received no response. On some more poking
around it seems that the "error code" value in this log entry type is an
NTSTATUS value (see below). If so, then this error represents,
STATUS_PROCEDURE_NOT_FOUND.

Would someone from Microsoft see fit to confirm this and raise it as a
defect? Title along the lines of:
"CHAP auth to IrNet port fails, and logs Event Log entry { Security, 681 }
with error code 3221225594"

To confirm it, first get the IrNet connection between two machines working
then set "netsh -c ras set authmode STANDARD", the connect will then fail
logging the two Event Log entries shown.



** On Event 681 error code being NTSTATUS values
This seem confirmed by matching the values in ntstatus.h (from the Platform
SDK) with those in KB273499--"Description of Security Event 681". For
example:

Error Code, Hexadecimal Value Error Code, Cause

3221225572, C0000064, User logon with misspelled or bad user account
STATUS_NO_SUCH_USER ((NTSTATUS)0xC0000064L)

3221225578 C000006A User logon with misspelled or bad password
STATUS_WRONG_PASSWORD ((NTSTATUS)0xC000006AL)

3221225581 C000006D User logon has incorrect user name
STATUS_LOGON_FAILURE ((NTSTATUS)0xC000006DL)
etc etc


** Original post:
 
Back
Top