1

Reviewing some logs recently, and came across a strange failure in our Windows 2008 DC.

An account failed to log on.

Subject:
        Security ID:            NULL SID
        Account Name:           -
        Account Domain:         -
        Logon ID:               0x0

Logon Type:                     3

Account For Which Logon Failed:
        Security ID:            NULL SID
        Account Name:           @
        Account Domain:             

Failure Information:
        Failure Reason:         Unknown user name or bad password.
        Status:                 0xc000006d
        Sub Status:             0xc0000064

Process Information:
        Caller Process ID:      0x0
        Caller Process Name:    -

Network Information:
        Workstation Name:       <REDACTED>
        Source Network Address: <REDACTED>
        Source Port:            4102

Any idea what this is?

This was an EventID of 4625, other failures nearby were another 4625 and a 4776.

Background: Redundant domain controllers, small LAN, some legacy software applications that might use older auth methods on the domain. Win Server 2008, Win XP SP3.

2 Answers 2

0

0xc0000064 means that the user name in the logon attempt did not match a known account. That would be the "Unknown user name" part of "Unknown user name or bad password". ;)

3
  • Good point. Any idea why the username would be an '@'?
    – MToecker
    Commented Nov 17, 2011 at 19:23
  • because whatever was logging in probably typed user@domain and some how user and domain were stripped out of the auth request.
    – Steve
    Commented Nov 17, 2011 at 20:15
  • Best Answer put in.. However, the 'some how' piece of the explanation does not seem plausible.
    – MToecker
    Commented Nov 22, 2011 at 22:52
0

First thing I'd check for is some service installed to run as a user that doesn't exist anymore, those suck.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .