Account Logon Failed by Date and Account Logon Success by Date reports based on EventID: 681, but in Windows Server 2003 and Windows XP Microsoft eliminated event ID 681 and instead uses event ID 681 for both successful and failed NTLM authentication attempts. So on Windows Server 2003 and Windows XP don't look for event ID 681 and be sure to take into account the success/failure status of occurrences of event ID 680.
For more information refer to MS Auditing Policy description
This was fixed by modified "Account Logon Failed by Date" and "Account Logon Success by Date" reports, please
<a href="/manage-service-request">Contact Support</a> for the supported hotfix, which is now available from Quest, but it is only intended to correct the problem that is described in this article.
Only apply it to systems that are experiencing this specific problem. This hotfix may receive additional testing. Therefore, if you are not severely affected by this problem, Quest recommends that you wait for the next Aelita Intrust Report Pack that contains this hotfix.