Share via

audit failures 4625 - ReportingServicesService

Mohammed Shahvali. Shaik 6 Reputation points
2022-11-28T10:42:32.887+00:00

Please help as there are multiple audit failure evets are occurring.
(user account is not locked out and password is working fine, re applied password and restarted service but still issue remains same)

An account failed to log on.

Subject:
Security ID: Domain\sqladmin
Account Name: sqladmin
Account Domain: Domain
Logon ID: 0x3364218d

Logon Type: 2

Account For Which Logon Failed:
Security ID: NULL SID
Account Name: sqladmin
Account Domain: "domain"

Failure Information:
Failure Reason: Unknown user name or bad password.
Status: 0xc000006d
Sub Status: 0xc000006a

Process Information:
Caller Process ID: 0x1e14
Caller Process Name: F:\Program Files\Microsoft SQL Server\MSRS10_50.MSSQLSERVER\Reporting Services\ReportServer\bin\ReportingServicesService.exe

Network Information:
Workstation Name: "server name"
Source Network Address: -
Source Port: -

Detailed Authentication Information:
Logon Process: Advapi
Authentication Package: Negotiate
Transited Services: -
Package Name (NTLM only): -
Key Length: 0

Windows Server Security
Windows Server Security
Windows Server: A family of Microsoft server operating systems that support enterprise-level management, data storage, applications, and communications.Security: The precautions taken to guard against crime, attack, sabotage, espionage, or another threat.
1,902 questions

2 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Techshan 241 Reputation points
    2024-09-23T16:00:24.57+00:00

    We are also facing the same issue, anybody knows the solution for this reported problem

    0 comments
  2. Gulnaz Mushtaq 410 Reputation points MVP
    2024-12-02T19:18:02.1233333+00:00

    It sounds like you're dealing with a complicated issue. Event ID 4625 indicates a failed login attempt, and the details you provided suggest that the login failure is due to the account being disabled (Status: 0xC000006E). The account name is not being recognized (Sub Status: 0xC0000072). Check the status of the SQL service account in Active Directory so that it shouldn’t be disabled. Also, verify that there are no duplicate accounts with a similar name in your environment. Look at the application logs and verify that the application is not trying to use the disabled account. The audit policy should be correctly configured to capture relevant information. And one last thing to check whether the correct firewall rules are configured.

    If the problem persists, it might be helpful to consult with your IT security team or reach out to Microsoft support for further assistance.

    0 comments

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.