Solved

event 4625 - Computer account is failing logon with bad password (0xC000006A) from a nonexistent IP

Posted on 2016-11-01
1
144 Views
Last Modified: 2016-11-01
hello,

I'm getting this event about twice an hour on average on the computer attempted being logged into, MemberServer09  by computer account MemberServer22.   Logon type 3 indicates File/Print sharing -or- IIS type access.   MemberServer22  serves no purpose right now but has IIS installed for a symantec site.  I disabled the APP Pool on server 22 for those sites in IIS Console without effect.  I just also re-enabled those, then stopped IIS Server via console and stopped services via n
et stop WAS  && net stop w3svc

Open in new window

successfully, awaiting results.  Both servers running 2012 R2.

MemberServer09 is a domain controller, the events 4625 are logged here. see below.    Anyone know how to prevent these from coming up?




An account failed to log on.

Subject:
      Security ID:            NULL SID
      Account Name:            -
      Account Domain:            -
      Logon ID:            0x0

Logon Type:                  3

Account For Which Logon Failed:
      Security ID:            NULL SID
      Account Name:            MembersServer22$
      Account Domain:            MyDomain

Failure Information:
      Failure Reason:            Unknown user name or bad password.
      Status:                  0xC000006D
      Sub Status:            0xC000006A

Process Information:
      Caller Process ID:      0x0
      Caller Process Name:      -

Network Information:
      Workstation Name:      MembersServer22
      Source Network Address:      192.168.14.45
      Source Port:            65307

Detailed Authentication Information:
      Logon Process:            NtLmSsp
      Authentication Package:      NTLM
      Transited Services:      -
      Package Name (NTLM only):      -
      Key Length:            0

This event is generated when a logon request fails. It is generated on the computer where access was attempted.

The Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).

The Process Information fields indicate which account and process on the system requested the logon.

The Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The authentication information fields provide detailed information about this specific logon request.
      - Transited services indicate which intermediate services have participated in this logon request.
      - Package name indicates which sub-protocol was used among the NTLM protocols.
      - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
0
Comment
Question by:csg-unit
1 Comment
 
LVL 1

Accepted Solution

by:
csg-unit earned 0 total points
ID: 41869145
I resolved this, it turned out Server22 was cloned into the hyper-v environment and that was attempting to use the same computer account.  The clone was shut off, issue resolved.
0

Featured Post

Migrating Your Company's PCs

To keep pace with competitors, businesses must keep employees productive, and that means providing them with the latest technology. This document provides the tips and tricks you need to help you migrate an outdated PC fleet to new desktops, laptops, and tablets.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

The next five years are sure to bring developments that are just astonishing, and we will continue to try to find the balance between connectivity and security. Here are five major technological developments from the last five years and some predict…
As cyber crime continues to grow in both numbers and sophistication, a troubling trend of optimization has emerged over the last year.
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles from a Windows Server 2008 domain controller to a Windows Server 2012 domain controlle…
With Secure Portal Encryption, the recipient is sent a link to their email address directing them to the email laundry delivery page. From there, the recipient will be required to enter a user name and password to enter the page. Once the recipient …

685 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question