Solved

Help troubleshoot failed logins

Posted on 2014-10-16
4
171 Views
Last Modified: 2014-10-16
I am trying to troubleshoot failed login attempts from Computer X, there are over 70 failed attempts from this computer everyday . I have ran malware checks. What steps can I take to narrow down the offending behavior?

This is the log from the application server running server 2008 r2 standard.

-      System
-      Provider
[ Name]      Microsoft-Windows-Security-Auditing
[ Guid]      {54849625-5478-4994-A5BA-3E3B0328C30D}
EventID      4625
Version      0
Level      0
Task      12544
Opcode      0
Keywords      0x8010000000000000
-      TimeCreated
[ SystemTime]      2014-10-16T13:19:29.188669400Z
EventRecordID      4158093
Correlation
-      Execution
[ ProcessID]      544
[ ThreadID]      15400
Channel      Security
Computer      LLL-R310
Security
-      EventData
SubjectUserSid      S-1-0-0
SubjectUserName      -
SubjectDomainName      -
SubjectLogonId      0x0
TargetUserSid      S-1-0-0
TargetUserName      lisa
TargetDomainName      HOLDINGS-PC-05
Status      0xc000006d
FailureReason      %%2313
SubStatus      0xc000006a
LogonType      3
LogonProcessName      NtLmSsp
AuthenticationPackageName      NTLM
WorkstationName      HOLDINGS-PC-05
TransmittedServices      -
LmPackageName      -
KeyLength      0
ProcessId      0x0
ProcessName      -
IpAddress      192.168.25.64
IpPort      49307
0
Comment
Question by:peraspera
  • 2
  • 2
4 Comments
 
LVL 13

Accepted Solution

by:
Rizzle earned 500 total points
ID: 40384708
Is there anything in the credential manager on the offending machine?

Are there any applications which would be using domain credentials on the machine whilst being open? Outlook or Citrix?

Have you tried dis-joining this machine from the domain and then re-joining it?

Maybe this might help:

http://blogs.technet.com/b/askds/archive/2008/05/14/troubleshooting-kerberos-authentication-problems-name-resolution-issues.aspx
0
 

Author Comment

by:peraspera
ID: 40384731
Thanks for the reply, the PC is on the same network as the server, but there is no domain controller.
0
 
LVL 13

Expert Comment

by:Rizzle
ID: 40384866
Is your machine not in a domain? Also have you checked the other things I mentioned.
0
 

Author Comment

by:peraspera
ID: 40385263
Your credential management suggestion was a huge help!

There is a Himachi user that had some old credentials hanging out.
0

Featured Post

Netscaler Common Configuration How To guides

If you use NetScaler you will want to see these guides. The NetScaler How To Guides show administrators how to get NetScaler up and configured by providing instructions for common scenarios and some not so common ones.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Convert websphere application server default chained Certificates from 1024 to 2048 keysize or higher size and also you can change signatureAlgorithm . Please make sure Websphere Application Server fixpack 7.0.0.23 or Above. The following steps a…
Possible fixes for Windows 7 and Windows Server 2008 updating problem. Solutions mentioned are from Microsoft themselves. I started a case with them from our Microsoft Silver Partner option to open a case and get direct support from Microsoft. If s…
This tutorial will give a an overview on how to deploy remote agents in Backup Exec 2012 to new servers. Click on the Backup Exec button in the upper left corner. From here, are global settings for the application such as connecting to a remote Back…
To efficiently enable the rotation of USB drives for backups, storage pools need to be created. This way no matter which USB drive is installed, the backups will successfully write without any administrative intervention. Multiple USB devices need t…

910 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

24 Experts available now in Live!

Get 1:1 Help Now