How to find out which account attempted to logon when event ID 40970 and error 0xc000006d is generated in event viewer?

Question

Event ID: 40970

Administrative Events

The Security System has detected a downgrade attempt when contacting the 3-part SPN

LDAP/XY-RoDC.abc.example.com/******@ABC.EXAMPLE.COM with error code "The attempted logon is invalid.

This is either due to a bad username or authentication information. (0xc000006d)". Authentication was denied.

Answer 1

Hi jackin:

To find out which account attempted to logon when event ID 40970 and error 0xc000006d is generated in event viewer, you can check the Security event log on the domain controller where the event occurred. Look for event ID 4625, which will provide information about the failed logon attempt, including the account name and the source IP address. You can use this information to investigate further and determine the cause of the failed logon attempt.

Here is a link to the documentation on event id 4625:4625(F) (Windows 10) - Windows security | Microsoft Learn

Kind regards,

Qiuyang

Answer 2

Gonna try this and update you. Thanks!

Answer 3

PS C:\Windows\system32> get-aduser someUsername -properties * | select lastbadpasswordattempt

lastbadpasswordattempt

---

12/5/2023 4:35:26 PM

Checked logs in event viewer on XY-RoDC> security logs around this time.

Looked for event ID 4625 no log event ID 4625 showed up for 12/5/2023 4:35:26 PM

So I found no related event ID 4625 in security logs which corelates with last bad password attempt and when account locked. I did find event ID 4740, which is telling about account locked, why it locked I don't know.

Answer 4

Hi jackin:

Based on the information you provided, it seems that the account was locked due to too many failed login attempts. The event ID 4740 indicates that the account was locked. However, without further information, it is difficult to determine why the account was locked. It is possible that the user exceeded the maximum number of allowed login attempts or that there was a security policy in place that triggered the lockout.

Kind regards,

Qiuyang