Strange Event Log Entry - Windows Server 2008

Question

Reviewing some logs recently, and came across a strange failure in our Windows 2008 DC.

An account failed to log on.

Subject:
        Security ID:            NULL SID
        Account Name:           -
        Account Domain:         -
        Logon ID:               0x0

Logon Type:                     3

Account For Which Logon Failed:
        Security ID:            NULL SID
        Account Name:           @
        Account Domain:             

Failure Information:
        Failure Reason:         Unknown user name or bad password.
        Status:                 0xc000006d
        Sub Status:             0xc0000064

Process Information:
        Caller Process ID:      0x0
        Caller Process Name:    -

Network Information:
        Workstation Name:       <REDACTED>
        Source Network Address: <REDACTED>
        Source Port:            4102

Any idea what this is?

This was an EventID of 4625, other failures nearby were another 4625 and a 4776.

Background: Redundant domain controllers, small LAN, some legacy software applications that might use older auth methods on the domain. Win Server 2008, Win XP SP3.

Answer 1

0xc0000064 means that the user name in the logon attempt did not match a known account. That would be the "Unknown user name" part of "Unknown user name or bad password". ;)

Answer 2

First thing I'd check for is some service installed to run as a user that doesn't exist anymore, those suck.