Event Viewer - Wikipedia, the free encyclopedia

... when a user's authentication fails, the system may generate Event ID 672. Windows NT 4.0 added support for defining "event sources" (i.e. the application which created the event) and performing backups ...

en.wikipedia.org