Solved

event 4625 - Computer account is failing logon with bad password (0xC000006A) from a nonexistent IP

Posted on 2016-11-01
1
106 Views
Last Modified: 2016-11-01
hello,

I'm getting this event about twice an hour on average on the computer attempted being logged into, MemberServer09  by computer account MemberServer22.   Logon type 3 indicates File/Print sharing -or- IIS type access.   MemberServer22  serves no purpose right now but has IIS installed for a symantec site.  I disabled the APP Pool on server 22 for those sites in IIS Console without effect.  I just also re-enabled those, then stopped IIS Server via console and stopped services via n
et stop WAS  && net stop w3svc

Open in new window

successfully, awaiting results.  Both servers running 2012 R2.

MemberServer09 is a domain controller, the events 4625 are logged here. see below.    Anyone know how to prevent these from coming up?




An account failed to log on.

Subject:
      Security ID:            NULL SID
      Account Name:            -
      Account Domain:            -
      Logon ID:            0x0

Logon Type:                  3

Account For Which Logon Failed:
      Security ID:            NULL SID
      Account Name:            MembersServer22$
      Account Domain:            MyDomain

Failure Information:
      Failure Reason:            Unknown user name or bad password.
      Status:                  0xC000006D
      Sub Status:            0xC000006A

Process Information:
      Caller Process ID:      0x0
      Caller Process Name:      -

Network Information:
      Workstation Name:      MembersServer22
      Source Network Address:      192.168.14.45
      Source Port:            65307

Detailed Authentication Information:
      Logon Process:            NtLmSsp
      Authentication Package:      NTLM
      Transited Services:      -
      Package Name (NTLM only):      -
      Key Length:            0

This event is generated when a logon request fails. It is generated on the computer where access was attempted.

The Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).

The Process Information fields indicate which account and process on the system requested the logon.

The Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The authentication information fields provide detailed information about this specific logon request.
      - Transited services indicate which intermediate services have participated in this logon request.
      - Package name indicates which sub-protocol was used among the NTLM protocols.
      - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
0
Comment
Question by:csg-unit
1 Comment
 
LVL 1

Accepted Solution

by:
csg-unit earned 0 total points
ID: 41869145
I resolved this, it turned out Server22 was cloned into the hyper-v environment and that was attempting to use the same computer account.  The clone was shut off, issue resolved.
0

Featured Post

Three Reasons Why Backup is Strategic

Backup is strategic to your business because your data is strategic to your business. Without backup, your business will fail. This white paper explains why it is vital for you to design and immediately execute a backup strategy to protect 100 percent of your data.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

As technology users and professionals, we’re always learning. Our universal interest in advancing our knowledge of the trade is unmatched by most industries. It’s a curiosity that makes sense, given the climate of change. Within that, there lies a…
As a business owner, there are many things that keep you up at night. Profit margins, employee retention, human resource protocols, whether your product or service will remain competitive. When you own or manage a technology company that operates la…
This tutorial will walk an individual through the process of installing the necessary services and then configuring a Windows Server 2012 system as an iSCSI target. To install the necessary roles, go to Server Manager, and select Add Roles and Featu…
Sending a Secure fax is easy with eFax Corporate (http://www.enterprise.efax.com). First, Just open a new email message.  In the To field, type your recipient's fax number @efaxsend.com. You can even send a secure international fax — just include t…

777 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question