Solved

event 4625 - Computer account is failing logon with bad password (0xC000006A) from a nonexistent IP

Posted on 2016-11-01
1
124 Views
Last Modified: 2016-11-01
hello,

I'm getting this event about twice an hour on average on the computer attempted being logged into, MemberServer09  by computer account MemberServer22.   Logon type 3 indicates File/Print sharing -or- IIS type access.   MemberServer22  serves no purpose right now but has IIS installed for a symantec site.  I disabled the APP Pool on server 22 for those sites in IIS Console without effect.  I just also re-enabled those, then stopped IIS Server via console and stopped services via n
et stop WAS  && net stop w3svc

Open in new window

successfully, awaiting results.  Both servers running 2012 R2.

MemberServer09 is a domain controller, the events 4625 are logged here. see below.    Anyone know how to prevent these from coming up?




An account failed to log on.

Subject:
      Security ID:            NULL SID
      Account Name:            -
      Account Domain:            -
      Logon ID:            0x0

Logon Type:                  3

Account For Which Logon Failed:
      Security ID:            NULL SID
      Account Name:            MembersServer22$
      Account Domain:            MyDomain

Failure Information:
      Failure Reason:            Unknown user name or bad password.
      Status:                  0xC000006D
      Sub Status:            0xC000006A

Process Information:
      Caller Process ID:      0x0
      Caller Process Name:      -

Network Information:
      Workstation Name:      MembersServer22
      Source Network Address:      192.168.14.45
      Source Port:            65307

Detailed Authentication Information:
      Logon Process:            NtLmSsp
      Authentication Package:      NTLM
      Transited Services:      -
      Package Name (NTLM only):      -
      Key Length:            0

This event is generated when a logon request fails. It is generated on the computer where access was attempted.

The Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).

The Process Information fields indicate which account and process on the system requested the logon.

The Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The authentication information fields provide detailed information about this specific logon request.
      - Transited services indicate which intermediate services have participated in this logon request.
      - Package name indicates which sub-protocol was used among the NTLM protocols.
      - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
0
Comment
Question by:csg-unit
1 Comment
 
LVL 1

Accepted Solution

by:
csg-unit earned 0 total points
ID: 41869145
I resolved this, it turned out Server22 was cloned into the hyper-v environment and that was attempting to use the same computer account.  The clone was shut off, issue resolved.
0

Featured Post

Efficient way to get backups off site to Azure

This user guide provides instructions on how to deploy and configure both a StoneFly Scale Out NAS Enterprise Cloud Drive virtual machine and Veeam Cloud Connect in the Microsoft Azure Cloud.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
SYSVOL corrupted 12 92
Display which user(s) is logged in to Access DB over the network 3 36
rajdeep0081@hotmail.com 3 72
Cannot access RDP (AD 2012) 6 21
In this increasingly digital world, security hacks are no longer just a threat, but a reality. As we've witnessed with Target's big identity hack 2013, Heartbleed in 2015, and now Cloudbleed, companies and their leaders need to prepare for the unthi…
February 24, 2017 — On February 23, Travis Ormandy, a vulnerability researcher at Google, reported on Twitter (https://twitter.com/taviso/status/834900838837411840) that massive stores of data have been leaked by CloudFlare, a company that provide…
In this Micro Tutorial viewers will learn how to use Boot Corrector from Paragon Rescue Kit Free to identify and fix the boot problems of Windows 7/8/2012R2 etc. As an example is used Windows 2012R2 which lost its active partition flag (often happen…
Sending a Secure fax is easy with eFax Corporate (http://www.enterprise.efax.com). First, Just open a new email message.  In the To field, type your recipient's fax number @efaxsend.com. You can even send a secure international fax — just include t…

828 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question