Solved

event 4625 - Computer account is failing logon with bad password (0xC000006A) from a nonexistent IP

Posted on 2016-11-01
1
91 Views
Last Modified: 2016-11-01
hello,

I'm getting this event about twice an hour on average on the computer attempted being logged into, MemberServer09  by computer account MemberServer22.   Logon type 3 indicates File/Print sharing -or- IIS type access.   MemberServer22  serves no purpose right now but has IIS installed for a symantec site.  I disabled the APP Pool on server 22 for those sites in IIS Console without effect.  I just also re-enabled those, then stopped IIS Server via console and stopped services via n
et stop WAS  && net stop w3svc

Open in new window

successfully, awaiting results.  Both servers running 2012 R2.

MemberServer09 is a domain controller, the events 4625 are logged here. see below.    Anyone know how to prevent these from coming up?




An account failed to log on.

Subject:
      Security ID:            NULL SID
      Account Name:            -
      Account Domain:            -
      Logon ID:            0x0

Logon Type:                  3

Account For Which Logon Failed:
      Security ID:            NULL SID
      Account Name:            MembersServer22$
      Account Domain:            MyDomain

Failure Information:
      Failure Reason:            Unknown user name or bad password.
      Status:                  0xC000006D
      Sub Status:            0xC000006A

Process Information:
      Caller Process ID:      0x0
      Caller Process Name:      -

Network Information:
      Workstation Name:      MembersServer22
      Source Network Address:      192.168.14.45
      Source Port:            65307

Detailed Authentication Information:
      Logon Process:            NtLmSsp
      Authentication Package:      NTLM
      Transited Services:      -
      Package Name (NTLM only):      -
      Key Length:            0

This event is generated when a logon request fails. It is generated on the computer where access was attempted.

The Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).

The Process Information fields indicate which account and process on the system requested the logon.

The Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The authentication information fields provide detailed information about this specific logon request.
      - Transited services indicate which intermediate services have participated in this logon request.
      - Package name indicates which sub-protocol was used among the NTLM protocols.
      - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
0
Comment
Question by:csg-unit
1 Comment
 
LVL 1

Accepted Solution

by:
csg-unit earned 0 total points
ID: 41869145
I resolved this, it turned out Server22 was cloned into the hyper-v environment and that was attempting to use the same computer account.  The clone was shut off, issue resolved.
0

Featured Post

Windows Server 2016: All you need to know

Learn about Hyper-V features that increase functionality and usability of Microsoft Windows Server 2016. Also, throughout this eBook, you’ll find some basic PowerShell examples that will help you leverage the scripts in your environments!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Nothing in an HTTP request can be trusted, including HTTP headers and form data.  A form token is a tool that can be used to guard against request forgeries (CSRF).  This article shows an improved approach to form tokens, making it more difficult to…
Every computer eventually fails. When that happens, your valuable data is only as safe as your current backup.
In this Micro Tutorial viewers will learn how to use Windows Server Backup to create full image of their system. Tutorial shows how to install Windows Server Backup Feature on Windows 2012R2 and how to configure scheduled Bare Metal Recovery backup.…
This tutorial will walk an individual through the process of configuring their Windows Server 2012 domain controller to synchronize its time with a trusted, external resource. Use Google, Bing, or other preferred search engine to locate trusted NTP …

932 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

11 Experts available now in Live!

Get 1:1 Help Now