Audit failure 4776 as Windows recognize domain account as a local account and think the account doesn't exist

asked 2022-12-22T06:21:32.25+00:00
Itsarapong Intoum 1 Reputation point

Hi,

I've a Windows server which's running VEEAM B&R and this VEEAM connect to the vCenter server with domain account. The event log shows the audit failure event with detail below

Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account: veeamprod2.svc
Source Workstation: *
Error Code: 0xC0000064

*The source workstation is this server itself. the logon account veeamprod2.svc is actually a domain account

Have anyone experienced this before?

Thank you.

Windows Server
Windows Server
A family of Microsoft server operating systems that support enterprise-level management, data storage, applications, and communications.
8,142 questions
Windows Server Security
Windows Server Security
Windows Server: A family of Microsoft server operating systems that support enterprise-level management, data storage, applications, and communications.Security: The precautions taken to guard against crime, attack, sabotage, espionage, or another threat.
1,295 questions
No comments
{count} votes

1 answer

Sort by: Most helpful
  1. answered 2022-12-29T14:11:39.12+00:00
    Sean O'Brien 6 Reputation points

    ello

    Thank you for your question and reaching out. I can understand you are having query\issues related to Audit failure with event ID 4776.

    0xC0000064 = The username you typed does not exist. Bad username. Hene ,Please verify that username is configured in correct format in VEEAM software , For example serviceaccount@keyman .local or domain.local\ serviceaccount

    Reference :

    https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4776

    ------------------------------------------------------------------------------------------------------------------------------

    --If the reply is helpful, please Upvote and Accept as answer--