Help troubleshoot failed logins

I am trying to troubleshoot failed login attempts from Computer X, there are over 70 failed attempts from this computer everyday . I have ran malware checks. What steps can I take to narrow down the offending behavior?

This is the log from the application server running server 2008 r2 standard.

-      System
-      Provider
[ Name]      Microsoft-Windows-Security-Auditing
[ Guid]      {54849625-5478-4994-A5BA-3E3B0328C30D}
EventID      4625
Version      0
Level      0
Task      12544
Opcode      0
Keywords      0x8010000000000000
-      TimeCreated
[ SystemTime]      2014-10-16T13:19:29.188669400Z
EventRecordID      4158093
Correlation
-      Execution
[ ProcessID]      544
[ ThreadID]      15400
Channel      Security
Computer      LLL-R310
Security
-      EventData
SubjectUserSid      S-1-0-0
SubjectUserName      -
SubjectDomainName      -
SubjectLogonId      0x0
TargetUserSid      S-1-0-0
TargetUserName      lisa
TargetDomainName      HOLDINGS-PC-05
Status      0xc000006d
FailureReason      %%2313
SubStatus      0xc000006a
LogonType      3
LogonProcessName      NtLmSsp
AuthenticationPackageName      NTLM
WorkstationName      HOLDINGS-PC-05
TransmittedServices      -
LmPackageName      -
KeyLength      0
ProcessId      0x0
ProcessName      -
IpAddress      192.168.25.64
IpPort      49307
perasperaAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

RizzleCommented:
Is there anything in the credential manager on the offending machine?

Are there any applications which would be using domain credentials on the machine whilst being open? Outlook or Citrix?

Have you tried dis-joining this machine from the domain and then re-joining it?

Maybe this might help:

http://blogs.technet.com/b/askds/archive/2008/05/14/troubleshooting-kerberos-authentication-problems-name-resolution-issues.aspx
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
perasperaAuthor Commented:
Thanks for the reply, the PC is on the same network as the server, but there is no domain controller.
0
RizzleCommented:
Is your machine not in a domain? Also have you checked the other things I mentioned.
0
perasperaAuthor Commented:
Your credential management suggestion was a huge help!

There is a Himachi user that had some old credentials hanging out.
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Application Servers

From novice to tech pro — start learning today.