obsorved event id 4625 on a sql server with a unknown username

Question

obsorved event id 4625 on a sql server with a unknown username

Kumar, Deepak 16

useraneme :\@@CyBAAAAUBQYAMHArBwUAMGAoBQZAQGA1BAbAUGAyBgOAQFAhBwcAsGA6AweAYDA0AQNAIEABBAMAUDA3AQLAQEA4AwNAUEAtAANAYEA5AQQA0CACBAOAcDA1AQLAMEADBAOAQEA1AAMAMEAxAANAQEAxAwQA0HA

Event id: 4625

Authentication Package Name: Negotiate
Failure Reason: %%2313 - Unknown username or bad password. (529)
Log on type: 4 – Batch - Batch logon type is used by batch servers, where processes may be executing on behalf of a user without their direct intervention.
The logon process is marked as "advapi"

can somebody make me understand why such a random username tried to make a connection. haven't observed any external or internal suspicious activity

Erland Sommarskog 122K Reputation points MVP Volunteer Moderator

2022-07-08T22:09:42.54+00:00

Where you see this? In the Windows event log? I see no connection to SQL Server. Am I missing something?
Kumar, Deepak 16 Reputation points

2022-07-09T00:18:20.233+00:00

Yes In windows event logs
Erland Sommarskog 122K Reputation points MVP Volunteer Moderator

2022-07-09T08:28:28.74+00:00

And do think this is related to SQL Server? Is there something I'm missing?
Dan Guzman 9,406 Reputation points

2022-07-09T10:54:57.797+00:00

Adding to Erland's comment, this is a failed login attempt at the OS level, unrelated to authentication to SQL Server. Although you mentioned you haven't observed any suspicious activity, this warrants further investigation, especially on a database server. If it's the same odd-looking username being used repeatedly, it could be an just an application that forgot to decrypt stored credentials.
CathyJi-MSFT 22,396 Reputation points Microsoft External Staff

2022-07-11T09:55:48.347+00:00

Hi @Anonymous ,

It seems that the error message is not related to SQL server. Did you get any related error message from SQL server error log?
Kumar, Deepak 16 Reputation points

2022-07-11T10:55:37.223+00:00

No this is from windows security log.
There was only one event.
SQL server is installed on this vm in azure.
Erland Sommarskog 122K Reputation points MVP Volunteer Moderator

2022-07-11T11:04:21.407+00:00

Just because SQL Server is installed on the machine, does not mean that sql-server-general is the best tag.

I gopgled a little on "advapi". From what I saw, it's not really something I would expect on an Azure VM. A better tag may give you better answers.

1 answer

Your answer

Erland Sommarskog 122K Reputation points MVP Volunteer Moderator

2022-07-08T22:09:42.54+00:00

Where you see this? In the Windows event log? I see no connection to SQL Server. Am I missing something?
Kumar, Deepak 16 Reputation points

2022-07-09T00:18:20.233+00:00

Yes In windows event logs
Erland Sommarskog 122K Reputation points MVP Volunteer Moderator

2022-07-09T08:28:28.74+00:00

And do think this is related to SQL Server? Is there something I'm missing?
Dan Guzman 9,406 Reputation points

2022-07-09T10:54:57.797+00:00

Adding to Erland's comment, this is a failed login attempt at the OS level, unrelated to authentication to SQL Server. Although you mentioned you haven't observed any suspicious activity, this warrants further investigation, especially on a database server. If it's the same odd-looking username being used repeatedly, it could be an just an application that forgot to decrypt stored credentials.
CathyJi-MSFT 22,396 Reputation points Microsoft External Staff

2022-07-11T09:55:48.347+00:00

Hi @Anonymous ,

It seems that the error message is not related to SQL server. Did you get any related error message from SQL server error log?
Kumar, Deepak 16 Reputation points

2022-07-11T10:55:37.223+00:00

No this is from windows security log.
There was only one event.
SQL server is installed on this vm in azure.
Erland Sommarskog 122K Reputation points MVP Volunteer Moderator

2022-07-11T11:04:21.407+00:00

Just because SQL Server is installed on the machine, does not mean that sql-server-general is the best tag.

I gopgled a little on "advapi". From what I saw, it's not really something I would expect on an Azure VM. A better tag may give you better answers.

Answer 1

Hello @Anonymous ,

I hope some of the above conversations helped you understand the possible causes behind Event Id 4625. There is a detailed information on this event Id in the below Microsoft document link for your reference.
https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4625

--please don't forget to upvote and accept as answer if any of the replies are helpful--

**What is the importance of accepting answers in case they helped you? **
You as an original poster by accepting answers will be helping other community members in finding the appropriate solutions in an effective way.

Share via

obsorved event id 4625 on a sql server with a unknown username

1 answer

Your answer