Windows server 2016 essential login failure 4625

Question

within the last week I am getting error 4625 on my Windows Security event viewer log. This is a on premise server not a VM, 4 workstations joined to the Domain. Here is the information from the event viewer. please let me know what else do you need to give me resolution.

Thanks,

Jamshid

An account failed to log on.

Subject:

Security ID:		SYSTEM

Account Name:		MLFSERVER$

Account Domain:		ABCDMLF

Logon ID:		0x3E7
```Logon Type:			3

Account For Which Logon Failed:

```sql
Security ID:		NULL SID

Account Name:		

Account Domain:		
```Failure Information:

```sql
Failure Reason:		Unknown user name or bad password.

Status:			0xC000006D

Sub Status:		0xC0000064
```Process Information:

```powershell
Caller Process ID:	0x38c

Caller Process Name:	C:\Windows\System32\lsass.exe
```Network Information:

```sql
Workstation Name:	MLFSERVER

Source Network Address:	-

Source Port:		-
```Detailed Authentication Information:

```yaml
Logon Process:		Schannel

Authentication Package:	Kerberos

Transited Services:	-

Package Name (NTLM only):	-

Key Length:		0
```This event is generated when a logon request fails. It is generated on the computer where access was attempted.

The Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).

The Process Information fields indicate which account and process on the system requested the logon.

The Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The authentication information fields provide detailed information about this specific logon request.

```yaml
- Transited services indicate which intermediate services have participated in this logon request.

- Package name indicates which sub-protocol was used among the NTLM protocols.

- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.

Answer 1

Hi,

The logon type 3 indicates a user or computer logged on to this computer from the network. The Security ID is NULL SID in event 4625 because the logon request failed, and the system could not determine the security identifier (SID) for the account that attempted the logon. This can happen for various reasons, such as the user not being granted the requested logon type at the machine, the account being disabled, or the account name containing junk characters due to issues with third-party components or incorrect configurations.

https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4625

Best Regards,

Ian Xue

---

If the Answer is helpful, please click "Accept Answer" and upvote it.

Answer 2

Hi Jamshid,

Work through the article Ian posted

Status 0xC000006D
"STATUS_LOGON_FAILURE" "The attempted logon is invalid. This is either due to a bad username or authentication information."

Sub Status: 0xC0000064
"STATUS_NO_SUCH_USER" "The specified account does not exist"

Workstation Name: MLFSERVER - This is the machine from which the logon request came which in this case seems to be the same machine.

Source Network Address: -

It looks like you have cut some information out of the event so it is difficult to advise further.

Can you provide the full event information.

Can you also advise if this event is in the Domain Controller's log, on the server's log, or on the new workstations' logs.

However, from what you have provided, it could be a lot of things including....

1. The new machines have not been added to the domain (not been added correctly).
2. The user name entered on the logon screen is incorrect or incorrect format
3. There is a service or scheduled task or some other automation on the workstaions which is using an incoorect user name to try and access server/services.

If it is not obvious from going through the referenced article in detail, I would recommend to have a look on the workstations' logs for other errors and warnings at or about the same time as the one you are looking at for further hints.

Good luck