4625 Event ID shows own pc name as the account name and security ID on Null SID

Question

Can anyone shed light as I'm getting the error below, on a pattern, every 7 PM daily and 8 AM weekly on one of our *servers (?). No scripts running, and no task/s scheduled to run.

I do get that it is coming somewhere remotely as it has a logon type of 3 but the IP is coming from itself. We got tons of notifications about this one, but the only value changing is the source port and everything else is constant.

Have already enabled NTLM Auditing and didn’t show much information. Please see NTLM Log.

Where/what else can I check to get this sorted out?

An account failed to log on.

Subject:

            Security ID:                         NULL SID  

            Account Name:                 -  

            Account Domain:                              -  

            Logon ID:                             0x0  

 

Logon Type: 3

Account For Which Logon Failed:

            Security ID:                         NULL SID  

            Account Name:                 Server$  

            Account Domain:                              (redacted)  

 

Failure Information:

            Failure Reason:                 An Error occurred during Logon.  

            Status:                                  0xC000006D  

            Sub Status:                         0x0  

 

Process Information:

            Caller Process ID:              0x0  

            Caller Process Name:      -  

 

Network Information:

            Workstation Name:         Server  

            Source Network Address:           172.16.0.12  

            Source Port:                       57772  

 

Detailed Authentication Information:

            Logon Process:                   

            Authentication Package:               NTLM  

            Transited Services:          -  

            Package Name (NTLM only):        -  

            Key Length:                        0  

 

This event is generated when a logon request fails. It is generated on the computer where access was attempted.

The Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).

The Process Information fields indicate which account and process on the system requested the logon.

The Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The authentication information fields provide detailed information about this specific logon request.

            - Transited services indicate which intermediate services have participated in this logon request.  

            - Package name indicates which sub-protocol was used among the NTLM protocols.  

            - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.  

----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

NTLM server blocked audit: Audit Incoming NTLM Traffic that would be blocked

Calling process PID: 4

Calling process name:

Calling process LUID: 0x3E7

Calling process user identity: Server$

Calling process domain identity: (redacted)

Mechanism OID: 1.3.6.1.4.1.311.2.2.10

Audit NTLM authentication requests to this server that would be blocked if the security policy Network Security: Restrict NTLM: Incoming NTLM Traffic is set to Deny all accounts or Deny all domain accounts.

If you want this server to allow NTLM authentication, set the security policy Network Security: Restrict NTLM: Incoming NTLM Traffic to Allow all.

Answer 1

Hello AdSys,

This may seem an error produced by the SYSTEM process of the computer (Process ID: 4) while using Network Level authentication. The fact that the reporting source is the same IP of the server would be normal in this cases, since you can see that is coming from an ephemeral port (57772), likely you have some server software running on the system that may need communication. The error codes indicate that:

• 0XC000006D The cause is either a bad username or authentication information (likely authentication information
• 0x0 Status OK. (user is correct but some authentication data was not valid)

The most common scenario for this is that the environment has blocked the usage of NTLM, as it contains different vulnerabilities. You can check the article below regarding disabling NTLM, if that is true, you may want to check if the applications installed on your system require NTLM, or if they can be configured to use NTLMv2 only or Kerberos.

References:
https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4625
https://learn.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-ntlm-authentication-in-this-domain

--If the reply is helpful, please Upvote and Accept as answer--

Answer 2

Try adding the following registries: HKLM\SYSTEM\CurrentControlSet\Services\lanmanserver\parameters DWORD: DisableStrictNameChecking and set value to "1"