Nath603
asked on
Audit Failure
I get an Audit Failure log every 25 seconds or so saying the following:
An account failed to log on.
Subject:
Security ID: NULL SID
Account Name: -
Account Domain: -
Logon ID: 0x0
Logon Type: 3
Account For Which Logon Failed:
Security ID: NULL SID
Account Name: CORR
Account Domain:
Failure Information:
Failure Reason: Unknown user name or bad password.
Status: 0xC000006D
Sub Status: 0xC0000064
Process Information:
Caller Process ID: 0x0
Caller Process Name: -
Network Information:
Workstation Name: -
Source Network Address: -
Source Port: -
Detailed Authentication Information:
Logon Process: NtLmSsp
Authentication Package: NTLM
Transited Services: -
Package Name (NTLM only): -
Key Length: 0
This event is generated when a logon request fails. It is generated on the computer where access was attempted.
The Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.
The Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).
The Process Information fields indicate which account and process on the system requested the logon.
The Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.
The authentication information fields provide detailed information about this specific logon request.
- Transited services indicate which intermediate services have participated in this logon request.
- Package name indicates which sub-protocol was used among the NTLM protocols.
- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
The only thing that changes every time is the account name. This happens constantly repeating itself every 25 seconds or so. What is this and how to I stop this?
An account failed to log on.
Subject:
Security ID: NULL SID
Account Name: -
Account Domain: -
Logon ID: 0x0
Logon Type: 3
Account For Which Logon Failed:
Security ID: NULL SID
Account Name: CORR
Account Domain:
Failure Information:
Failure Reason: Unknown user name or bad password.
Status: 0xC000006D
Sub Status: 0xC0000064
Process Information:
Caller Process ID: 0x0
Caller Process Name: -
Network Information:
Workstation Name: -
Source Network Address: -
Source Port: -
Detailed Authentication Information:
Logon Process: NtLmSsp
Authentication Package: NTLM
Transited Services: -
Package Name (NTLM only): -
Key Length: 0
This event is generated when a logon request fails. It is generated on the computer where access was attempted.
The Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.
The Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).
The Process Information fields indicate which account and process on the system requested the logon.
The Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.
The authentication information fields provide detailed information about this specific logon request.
- Transited services indicate which intermediate services have participated in this logon request.
- Package name indicates which sub-protocol was used among the NTLM protocols.
- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
The only thing that changes every time is the account name. This happens constantly repeating itself every 25 seconds or so. What is this and how to I stop this?
logon type 3 is a network logon, usually attributed to attempts to access a share.. It could also be a logon failure if you have windows logon enabled in IIS
ASKER
So does that mean someone from outside my network or some account within my network is trying to gain access?
disable IIS and see if audits end.. then you know it is from IIS, otherwise it is your network
ASKER
I disabled IIS and I was still getting those Audit failures. So I guess that means that its coming from within. Is there a way to find out where its coming from?
Strange that there is no workstation name.
Likely a scheduled job or services running doing RDP into DC. E.g. Check the task scheduler for any recurring jobs using outdated credentials
This event is only telling you that an authentication request failed due to bad username/password. It is still not shown any indication that your system is under unauthorized access or attack. Will also be good to see any other error beside this event 4625.
Likely a scheduled job or services running doing RDP into DC. E.g. Check the task scheduler for any recurring jobs using outdated credentials
This event is only telling you that an authentication request failed due to bad username/password. It is still not shown any indication that your system is under unauthorized access or attack. Will also be good to see any other error beside this event 4625.
ASKER
I just checked it this morning and the Audit is still failing and it seems it is still trying to use different account names so log in. I did check the scheduler and did not see anything in there.
The reason I feel its malicious is because if I leave it unchecked for a while I will have random spyware programs on this server. Programs that I know I didn't install on there.
The reason I feel its malicious is because if I leave it unchecked for a while I will have random spyware programs on this server. Programs that I know I didn't install on there.
The event should state workstation name. Regardless, better to scan the machine as likely if there is positive hit, it doesn't matters the audit log as it is mostly some exploiting the services to the file (or DC) server. Scan using hitmanpro (trial) and adware removal tool and malwarebytes anti-malware. They should give assurance on any hints of attack. May want to try run in safe mode
Do you have any third party software running, if yes, you may turn off it and check the result.
If the problem still persists, you can open a case with MS to look into the issue deeply for you.
Here is the link: https://support.microsoft.com/en-us/gp/support-options-for-business
Get help from this article to track the source of failed logon attempts in Active Directory.
Also check this earlier discussion: https://www.codeproject.com/Questions/1181782/Event-windows-security-auditing-failed-to-logon-Fa
Hope this helps!
If the problem still persists, you can open a case with MS to look into the issue deeply for you.
Here is the link: https://support.microsoft.com/en-us/gp/support-options-for-business
Get help from this article to track the source of failed logon attempts in Active Directory.
Also check this earlier discussion: https://www.codeproject.com/Questions/1181782/Event-windows-security-auditing-failed-to-logon-Fa
Hope this helps!
ASKER
No third party running. I do have an antivirus on the server and I've done a deep scan and didn't find anything.
The reason I feel its malicious is because if I leave it unchecked for a while I will have random spyware programs on this server. Programs that I know I didn't install on there.If you mentioned those extra programs, it is strange there is no findings from scan using those tools suggested. Please share more info on the observation mentioned.
ASKER
I ran all the programs and it came up with nothing. I've really been scratching my head as to what it could be.
Since no virus findings, check Scheduled Tasks, services running on clients. They may store old user passwords. They would be one of those machines. So let say disconnecting server from network, will the error still take place and if so it is locsl service but I doubt so.
Another is in syncing and the account resetting
Another is in syncing and the account resetting
Question
Sign in to vote
2
Sign in to vote
Hmm, seems that I have found a solution that worked for me.
My two DCs was out of sync with date and time - not only out of sync between each other but also compared to the client PC I tried to logon from.
With the time and date set correct on all servers and clients, I can now logon with rdp from PCs/clients that are non-domain and domain, with local admin (".\administator") and domain administrators.
For author advice.
ASKER
After disconnecting from the network the Audits are still failing however it is revealing more information. Not sure what to make of it.
Log Name: Security
Source: Microsoft-Windows-Security -Auditing
Date: 7/10/2017 2:06:11 PM
Event ID: 4625
Task Category: Logon
Level: Information
Keywords: Audit Failure
User: N/A
Computer: AVATS3.avancenat.org
Description:
An account failed to log on.
Subject:
Security ID: NULL SID
Account Name: -
Account Domain: -
Logon ID: 0x0
Logon Type: 3
Account For Which Logon Failed:
Security ID: NULL SID
Account Name: AVATS3$
Account Domain: AVANCENAT
Failure Information:
Failure Reason: An Error occured during Logon.
Status: 0xC000005E
Sub Status: 0x0
Process Information:
Caller Process ID: 0x0
Caller Process Name: -
Network Information:
Workstation Name: AVATS3
Source Network Address: ::1
Source Port: 57086
Detailed Authentication Information:
Logon Process: NtLmSsp
Authentication Package: NTLM
Transited Services: -
Package Name (NTLM only): -
Key Length: 0
This event is generated when a logon request fails. It is generated on the computer where access was attempted.
The Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.
The Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).
The Process Information fields indicate which account and process on the system requested the logon.
The Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.
The authentication information fields provide detailed information about this specific logon request.
- Transited services indicate which intermediate services have participated in this logon request.
- Package name indicates which sub-protocol was used among the NTLM protocols.
- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-Se curity-Aud iting" Guid="{54849625-5478-4994- A5BA-3E3B0 328C30D}" />
<EventID>4625</EventID>
<Version>0</Version>
<Level>0</Level>
<Task>12544</Task>
<Opcode>0</Opcode>
<Keywords>0x80100000000000 00</Keywor ds>
<TimeCreated SystemTime="2017-07-10T19: 06:11.2103 73200Z" />
<EventRecordID>712832</Eve ntRecordID >
<Correlation />
<Execution ProcessID="588" ThreadID="4496" />
<Channel>Security</Channel >
<Computer>AVATS3.avancenat .org</Comp uter>
<Security />
</System>
<EventData>
<Data Name="SubjectUserSid">S-1- 0-0</Data>
<Data Name="SubjectUserName">-</ Data>
<Data Name="SubjectDomainName">- </Data>
<Data Name="SubjectLogonId">0x0< /Data>
<Data Name="TargetUserSid">S-1-0 -0</Data>
<Data Name="TargetUserName">AVAT S3$</Data>
<Data Name="TargetDomainName">AV ANCENAT</D ata>
<Data Name="Status">0xc000005e</ Data>
<Data Name="FailureReason">%%230 4</Data>
<Data Name="SubStatus">0x0</Data >
<Data Name="LogonType">3</Data>
<Data Name="LogonProcessName">Nt LmSsp </Data>
<Data Name="AuthenticationPackag eName">NTL M</Data>
<Data Name="WorkstationName">AVA TS3</Data>
<Data Name="TransmittedServices" >-</Data>
<Data Name="LmPackageName">-</Da ta>
<Data Name="KeyLength">0</Data>
<Data Name="ProcessId">0x0</Data >
<Data Name="ProcessName">-</Data >
<Data Name="IpAddress">::1</Data >
<Data Name="IpPort">57086</Data>
</EventData>
</Event>
Log Name: Security
Source: Microsoft-Windows-Security
Date: 7/10/2017 2:06:11 PM
Event ID: 4625
Task Category: Logon
Level: Information
Keywords: Audit Failure
User: N/A
Computer: AVATS3.avancenat.org
Description:
An account failed to log on.
Subject:
Security ID: NULL SID
Account Name: -
Account Domain: -
Logon ID: 0x0
Logon Type: 3
Account For Which Logon Failed:
Security ID: NULL SID
Account Name: AVATS3$
Account Domain: AVANCENAT
Failure Information:
Failure Reason: An Error occured during Logon.
Status: 0xC000005E
Sub Status: 0x0
Process Information:
Caller Process ID: 0x0
Caller Process Name: -
Network Information:
Workstation Name: AVATS3
Source Network Address: ::1
Source Port: 57086
Detailed Authentication Information:
Logon Process: NtLmSsp
Authentication Package: NTLM
Transited Services: -
Package Name (NTLM only): -
Key Length: 0
This event is generated when a logon request fails. It is generated on the computer where access was attempted.
The Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.
The Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).
The Process Information fields indicate which account and process on the system requested the logon.
The Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.
The authentication information fields provide detailed information about this specific logon request.
- Transited services indicate which intermediate services have participated in this logon request.
- Package name indicates which sub-protocol was used among the NTLM protocols.
- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-Se
<EventID>4625</EventID>
<Version>0</Version>
<Level>0</Level>
<Task>12544</Task>
<Opcode>0</Opcode>
<Keywords>0x80100000000000
<TimeCreated SystemTime="2017-07-10T19:
<EventRecordID>712832</Eve
<Correlation />
<Execution ProcessID="588" ThreadID="4496" />
<Channel>Security</Channel
<Computer>AVATS3.avancenat
<Security />
</System>
<EventData>
<Data Name="SubjectUserSid">S-1-
<Data Name="SubjectUserName">-</
<Data Name="SubjectDomainName">-
<Data Name="SubjectLogonId">0x0<
<Data Name="TargetUserSid">S-1-0
<Data Name="TargetUserName">AVAT
<Data Name="TargetDomainName">AV
<Data Name="Status">0xc000005e</
<Data Name="FailureReason">%%230
<Data Name="SubStatus">0x0</Data
<Data Name="LogonType">3</Data>
<Data Name="LogonProcessName">Nt
<Data Name="AuthenticationPackag
<Data Name="WorkstationName">AVA
<Data Name="TransmittedServices"
<Data Name="LmPackageName">-</Da
<Data Name="KeyLength">0</Data>
<Data Name="ProcessId">0x0</Data
<Data Name="ProcessName">-</Data
<Data Name="IpAddress">::1</Data
<Data Name="IpPort">57086</Data>
</EventData>
</Event>
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.