Failed Logon attempts on SCCM server

Question

Hi Team,

From Last 2 months we are noticing the Failure login attempts logs from one of our SCCM server with logon type 3 and attempts were made from different sources/users, here the strange thing is user not tried form there end.

is it the known issues from SCCM server side? do we have any solution to to avoid/clean up those failure logon? if it is known issue and there is no solution, can we suppress those events from alerting? is there any security risk evaluated on the same?

Looking forward your reply asap.

Answer 1

Hello there,

What is the exact event ID getting generated?

Under normal circumstances, all machines joined to Domain will log failed login attempts in their own security logs in event viewer as well as that in a Domain Controller.

The below thread discusses the same issue and you can try out some troubleshooting steps from this and see if that helps you to sort the Issue.

https://learn.microsoft.com/en-us/answers/questions/498929/sccm-security-logs-event-id-4625-logon-type-3?page=2#answers

Hope this resolves your Query !!

--If the reply is helpful, please Upvote and Accept it as an answer--