Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Reviewing some logs recently, and came across a strange failure in our Windows 2008 DC.

An account failed to log on.

Subject:
        Security ID:            NULL SID
        Account Name:           -
        Account Domain:         -
        Logon ID:               0x0

Logon Type:                     3

Account For Which Logon Failed:
        Security ID:            NULL SID
        Account Name:           @
        Account Domain:             

Failure Information:
        Failure Reason:         Unknown user name or bad password.
        Status:                 0xc000006d
        Sub Status:             0xc0000064

Process Information:
        Caller Process ID:      0x0
        Caller Process Name:    -

Network Information:
        Workstation Name:       <REDACTED>
        Source Network Address: <REDACTED>
        Source Port:            4102

Any idea what this is?

This was an EventID of 4625, other failures nearby were another 4625 and a 4776.

Background: Redundant domain controllers, small LAN, some legacy software applications that might use older auth methods on the domain. Win Server 2008, Win XP SP3.

share|improve this question

2 Answers 2

up vote 0 down vote accepted

0xc0000064 means that the user name in the logon attempt did not match a known account. That would be the "Unknown user name" part of "Unknown user name or bad password". ;)

share|improve this answer
    
Good point. Any idea why the username would be an '@'? –  MToecker Nov 17 '11 at 19:23
    
because whatever was logging in probably typed user@domain and some how user and domain were stripped out of the auth request. –  Steve Nov 17 '11 at 20:15
    
Best Answer put in.. However, the 'some how' piece of the explanation does not seem plausible. –  MToecker Nov 22 '11 at 22:52

First thing I'd check for is some service installed to run as a user that doesn't exist anymore, those suck.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.