Failed Logon attempts on SCCM server

Avin Prakash 0 Reputation points
2023-03-14T08:05:13.5266667+00:00

Hi Team,

From Last 2 months we are noticing the Failure login attempts logs from one of our SCCM server with logon type 3 and attempts were made from different sources/users, here the strange thing is user not tried form there end.

is it the known issues from SCCM server side? do we have any solution to to avoid/clean up those failure logon? if it is known issue and there is no solution, can we suppress those events from alerting? is there any security risk evaluated on the same?

Looking forward your reply asap.

Windows Server
Windows Server
A family of Microsoft server operating systems that support enterprise-level management, data storage, applications, and communications.
12,032 questions
Microsoft Configuration Manager
0 comments No comments
{count} votes

1 answer

Sort by: Most helpful
  1. Limitless Technology 43,916 Reputation points
    2023-03-14T14:39:56.3566667+00:00

    Hello there,

    What is the exact event ID getting generated?

    Under normal circumstances, all machines joined to Domain will log failed login attempts in their own security logs in event viewer as well as that in a Domain Controller.

    The below thread discusses the same issue and you can try out some troubleshooting steps from this and see if that helps you to sort the Issue.

    https://learn.microsoft.com/en-us/answers/questions/498929/sccm-security-logs-event-id-4625-logon-type-3?page=2#answers

    Hope this resolves your Query !!

    --If the reply is helpful, please Upvote and Accept it as an answer--

    0 comments No comments