Event ID 4625 logged every second
hello,
first time in forum , hope answer this. have been researching issue no end. haven't been able find exact replication of info error. have checked similar cases , explored option such loopback check, time/date issues, etc. here event info on 2008r2 datacenter, although see on every server in our care. i'm aware of different logon types. i've seen scripts , task schedulers brute force attacks. ideas has solved issue? can't take being sent microsoft link explaining difference between logon types again. major issue can't find similar event ours. either have null security id or call process. servers dc's. appreciated. in advance!
account failed log on.subject:
security id: s-1-0-0
account name: -
account domain: -
logon id: 0x0
logon type: 3
account logon failed:
security id: s-1-0-0
account name: administrator
account domain: fxnb
failure information:
failure reason: unknown user name or bad password.
status: 0xc000006d
sub status: 0xc000006a
process information:
caller process id: 0x0
caller process name: -
network information:
workstation name: fxnb
source network address: x.xxx.xxx.xxx
source port: 51537
detailed authentication information:
logon process: ntlmssp
authentication package: ntlm
transited services: -
package name (ntlm only): -
key length: 0
event generated when logon request fails. generated on computer access attempted.
subject fields indicate account on local system requested logon. commonly service such server service,
hi,
logon type: 3 indicate user or computer logged on computer network.
failed logon attempt caused unknown username or bad password. means authentication failed.
for information troubleshooting account lockout, refer article below.
active directory: troubleshooting frequent account lockout
best regards,
jay
please remember mark replies answers if , un-mark them if provide no help. if have feedback technet subscriber support, contact tnmff@microsoft.com.
Windows Server > Security
Comments
Post a Comment