Task scheduler running user account as SYSTEM and instance window security log received event code 4625 for every time server start up

Infra_support 21 Reputation points
2020-09-26T16:51:42.453+00:00

Hi,

Good Evening.

I trying to update an existing task scheduler in my server.

Below is the setting I have done to update the existing task in task scheduler:
Task setting:-

  1. Triggers: At System Start up
  2. Running the task user account : SYSTEM
  3. Run whether user is logged on or not
  4. Run with highest privilege's

I have tried the following action for the existing task:

1) Manually run the task with updated setting.
Result: Run smoothly and there's no event 4625 logged in Event Viewer.

2) Restart server to trigger the updated existing task.
Result: After a few minutes server restarted, the window security log display event code 4625
Failure Information:
Failure Reason: Unknown user name or bad password.
Status: 0xC000006D
Sub Status: 0xC0000064

3) Manually run the existing task with another user account.
Result: Run smoothly and there's no event 4625 logged in Event Viewer.

4) Restart server to trigger the existing task with another user account.
Result: Run smoothly and there's no event 4625 logged in Event Viewer.

5) Create a new task with user account system and manually run the task.
Result: Run smoothly and there's no event 4625 logged in Event Viewer.

6) Restart server to trigger the new task.
Result: Run smoothly and there's no event 4625 logged in Event Viewer.

Kindly advice and assist the failure to run the existing updated task.

Thanks.

Windows Server 2016
Windows Server 2016
A Microsoft server operating system that supports enterprise-level management updated to data storage.
2,382 questions
Accepted answer
  1. Karlie Weng 14,486 Reputation points Microsoft Vendor
    2020-09-30T06:01:35.59+00:00

    Hi @Infra_support

    Here are some descriptions about event 4625：

    4625(F): An account failed to log on.
    https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4625

    Windows Security Log Event ID 4625
    https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=4625

    ----------

    If the Answer is helpful, please click "Accept Answer" and upvote it.
    Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

    Best Regards
    Karlie

1 additional answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Dave Patrick 426.1K Reputation points MVP
    2020-09-26T18:09:45.83+00:00

    What are the task details?