Reviewing some logs recently, and came across a strange failure in our Windows 2008 DC.
An account failed to log on. Subject: Security ID: NULL SID Account Name: - Account Domain: - Logon ID: 0x0 Logon Type: 3 Account For Which Logon Failed: Security ID: NULL SID Account Name: @ Account Domain: Failure Information: Failure Reason: Unknown user name or bad password. Status: 0xc000006d Sub Status: 0xc0000064 Process Information: Caller Process ID: 0x0 Caller Process Name: - Network Information: Workstation Name: <REDACTED> Source Network Address: <REDACTED> Source Port: 4102
Any idea what this is?
This was an EventID of 4625, other failures nearby were another 4625 and a 4776.
Background: Redundant domain controllers, small LAN, some legacy software applications that might use older auth methods on the domain. Win Server 2008, Win XP SP3.