Azure Antimalware (Endpoint Protection) says "your system administrator has restricted access to this app"

I see many posts about using SCCM to configure policies, etc., etc. However, I can't find any information about my specific issue:
I have installed the Antimalware extension on several Azure VMs. Only one VM allows access to "System Center Endpoint Protection". All the other ones say "your system administrator has restricted access to this app". Now, since I am the
system administrator, I am at a loss how to be able to see / configure the other VMs using this program.
I have not installed SCCM, since I didn't think I would need it. If, in fact, I must install SCCM, it pretty much defeats the purpose of an extension.
Any ideas would be greatly appreciated.
--- If I am in the wrong forum, please let me know where I should post my question, since there don't appear to be any forums discussing extensions for Azure.

Although azure endpoint protection is the same core technology as SCEP it is not managed in the same way. Also, if the ConfigMgr agent is not installed on these VMs, then it's quite impossible for ConfigMgr to the source of the issue here. You are better
off posting to an Azure forum.
However, did you elevate when launching the EP console?
Jason | http://blog.configmgrftw.com | @jasonsandys

Similar Messages

  • Your system administrator has restricted access to this app.

    Enabled the Endpoint role on primary site server.
    Enabled Endpoint protection in Default Client Settings
    We have Default Client Antimalware Policy set.
    When I click on System Center EndPoint Protection in All Programs I get following error:
    Your system administrator has restricted access to this app.

    I am getting this on several windows client builds with SCEP now, we don't have an Applocker policy at all, one of the computers in question is running Win 7 Pro!
    I cant see how it could be malware as the users are standard users.
    I also don't know how long its been like this, but a machine we just re-imaged last week is now doing it.
    going to re-image and see if an update is causing it.

  • Problem happening again. The maximum report processing jobs limit configured by your system administrator has been reached.

    We have started receiving load report failed error again in one of our production servers. This problem occurred some months ago and on that time we found that in the code reportdocument.close method was not called so we added into the code and set the print job limit to 400 and problem went away for couple of months but now it has started again.
    Load report failed.
       at CrystalDecisions.ReportAppServer.ReportClientDocumentWrapper.EnsureDocumentIsOpened()
       at CrystalDecisions.CrystalReports.Engine.ReportDocument.Load(String filename, OpenReportMethod openMethod, Int16 parentJob)
       at CrystalDecisions.CrystalReports.Engine.ReportDocument.Load(String filename)
       at AppSuite.WebApp.CrystalViewer.LoadReport(Boolean bRefresh)
       at AppSuite.WebApp.CrystalViewer.Page_Load(Object sender, EventArgs e)
       at System.Web.UI.Control.OnLoad(EventArgs e)
       at System.Web.UI.Control.LoadRecursive()
       at System.Web.UI.Page.ProcessRequestMain(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint)
    The maximum report processing jobs limit configured by your system administrator has been reached.
       at CrystalDecisions.ReportAppServer.ClientDoc.ReportClientDocumentClass.Open(Object& DocumentPath, Int32 Options)
       at CrystalDecisions.ReportAppServer.ReportClientDocumentWrapper.Open(Object& DocumentPath, Int32 Options)
       at CrystalDecisions.ReportAppServer.ReportClientDocumentWrapper.EnsureDocumentIsOpened()
    This is our code
    Private m_oReportDocument As New ReportDocument
        Private ReadOnly Property ReportId() As Integer
            Get
                Return Integer.Parse(Me.Request.QueryString("r"))
            End Get
        End Property
        Private Property CacheKey() As String
            Get
                Dim sCacheKey As String = Me.Request.QueryString("ck")
                If sCacheKey Is Nothing OrElse sCacheKey.Length = 0 Then
                    sCacheKey = CStr(Me.ViewState("CacheKey"))
                End If
                Return sCacheKey
            End Get
            Set(ByVal Value As String)
                Me.ViewState("CacheKey") = Value
            End Set
        End Property
        Private Sub Page_Load(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles MyBase.Load
            If Not Me.IsPostBack Then
                LoadReport()
            End If
        End Sub
        Private Sub btnPDF_Click(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles btnPDF.Click
            'Redirect to the PDF Viewer passing it the ReportId and CacheKey
            Me.Response.Redirect(String.Format(ReportHelper.PDFViewerURL, Me.ReportId, Me.CacheKey))
        End Sub
        Private Sub btnRTF_Click(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles btnRTF.Click
            'Redirect to the RTF Viewer passing it the ReportId and CacheKey
            Me.Response.Redirect(String.Format(ReportHelper.RTFViewerURL, Me.ReportId, Me.CacheKey))
        End Sub
        Private Sub btnExcel_Click(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles btnExcel.Click
            'Redirect to the Excel Viewer passing it the ReportId and CacheKey
            Me.Response.Redirect(String.Format(ReportHelper.ExcelViewerURL, Me.ReportId, Me.CacheKey))
        End Sub
        Private Sub crvMain_Navigate(ByVal source As Object, ByVal e As CrystalDecisions.Web.NavigateEventArgs) Handles crvMain.Navigate
            LoadReport()
        End Sub
        Private Sub crvMain_Search(ByVal source As Object, ByVal e As CrystalDecisions.Web.SearchEventArgs) Handles crvMain.Search
            LoadReport()
        End Sub
        Private Sub crvMain_ViewZoom(ByVal source As Object, ByVal e As CrystalDecisions.Web.ZoomEventArgs) Handles crvMain.ViewZoom
            LoadReport()
        End Sub
        Private Sub crvMain_Drill(ByVal source As Object, ByVal e As CrystalDecisions.Web.DrillEventArgs) Handles crvMain.Drill
            LoadReport()
        End Sub
        Private Sub crvMain_DrillDownSubreport(ByVal source As Object, ByVal e As CrystalDecisions.Web.DrillSubreportEventArgs) Handles crvMain.DrillDownSubreport
            LoadReport()
        End Sub
        Private Sub crvMain_ReportRefresh(ByVal source As Object, ByVal e As CrystalDecisions.Web.ViewerEventArgs) Handles crvMain.ReportRefresh
            LoadReport(True)
        End Sub
        Private Sub LoadReport()
            LoadReport(False)
        End Sub
        Private Sub LoadReport(ByVal bRefresh As Boolean)
            If Common.CouldBeMultiDB(User.Identity.Name) AndAlso TypedSession.OverrideCompany.Length > 0 Then
                Common.Settings.OverrideCompany = TypedSession.OverrideCompany
            End If
            'Get the report data
            Dim dtReport As DataTable = ReportHelper.GetReportData(Me.CacheKey, bRefresh)
            'If there is data to display bind it to the Crystal Viewer
            If dtReport.Rows.Count > 0 Then
                With m_oReportDocument
                    .Load(ReportHelper.GetReportPath(Me.ReportId))
                    .SetDataSource(dtReport)
                    .PrintOptions.PaperSize = Common.Settings.CrystalPaperSize
                End With
                crvMain.ReportSource = m_oReportDocument
            Else
                'Hide the controls and display a message if there is no data
                crvMain.Visible = False
                btnPDF.Visible = False
                btnExcel.Visible = False
                lblNoResults.Visible = True
            End If
        End Sub
        Protected Sub Page_Unload(ByVal sender As Object, ByVal e As System.EventArgs) Handles Me.Unload
            m_oReportDocument.Close()
            m_oReportDocument.Dispose()
        End Sub
    Can any one tell if we are doing anything wrong in our code. We don't use sub reports any more however we do use paging and some of our reports have 200+ pages. Also is it possible to find out print job limit and concurrent users by writing some code.
    Thanks

    I suspect it's not the code - after all it worked(?). It is much more likely that, it is the load. Remember that the report engine can only handle three concurrent requests at any one time. Also, remember that you can run out of print jobs real fast as subreports also count as print job. E.g.; say someone added a report that has 4 subreports in the detail section, the report runs a 100 records, you will be at 401 print jobs and thus over the limit. You can keep increasing the print job limit, but that means you are loading the server and eventually you will bring it down too...
    It may be time to consider, web farms or Report Application Server to scale up(?).
    Getting to the latest SP is never a bad idea either.
    And have a look at the scalability suggestions in this doc:
    Crystal Reports 2008 Component Engine Scalability
    - Ludek
    Senior Support Engineer AGS Product Support, Global Support Center Canada
    Follow us on Twitter

  • Im trying to uninstall itunes because the newest version wont download.  But when i go to uninstall, it says "The system administrator has set policies to prevent this uninstallation"  Whats can i do to uninstall

    Im trying to uninstall itunes because the newest version wont download.  But when i go to uninstall, it says "The system administrator has set policies to prevent this uninstallation"  Whats can i do to uninstall

    Windows right?
    Likely your not the administor any more, the botnet is.
    Check on this site really quick if your part of a botnet
    http://botnetchecker.com/
    All clear? Hopefully. Backup your files to a external drive, cd or dvd, USB keye etc off your computer.
    Run the sfx file on this site and it will burn to a cd.
    http://www.avira.com/en/support-download-avira-antivir-rescue-system
    Next hit your BIO's key and set the cd to boot first, run the scanner and see what it pops up.
    If your all clear then create another Admin, transfer your files over from the first Admin.
    See if that works, eventually when your totally over to the new Admin, delete the old one.
    If you can't create a new Admin, find out who locked your machine down, like your parents or it's a school computer?
    Likely installed spyware or "nanyware" to watch you.
    Hope that works.

  • HT1925 Message after removing and trying to reinstall itunes 'The system administrator has set policies preventing this installation'. Can anybody help?

    After removing and reinstlling iTunes .....message reads 'the system administrator has set policies preventing this installation'

    Try the following user tip:
    "The administrator has set policies to prevent this installation" error messages when installing iTunes for Windows on Windows Vista and Windows 7 systems

  • HT1926 Everytime I try and install iTunes it says "the system administrator has set policies to prevent this installation".  does anyone know what this means?

    I am using my partners computer.  He has iTunes on his laptop but when I went to update iTunes, it said "the system administrator has set policies to prevent this installation".  I therefore deleted iTunes altogether thinking to reinstall the original iTunes and then upgrade it (i,e start from scratch) but to know avail.  Is this a problem with my laptop itself?  Or a problem with the internet settings?
    HELP PLEASE!!

    Let's try something relatively simple. Download and save a copy of the installer to your hard drive (don't run the install on line and don't start the install just yet):
    http://www.apple.com/itunes/download/
    Now right-click on the iTunesSetup.exe (or iTunes64Setup.exe) that you downloaded and select "Run as administrator".
    Does that go through any better for you?

  • The system administrator has set policies to prevent this installation

    when installing itunes on mums sony vaio with vista home edition. a message saying "the system administrator has set policies to prevent this installation" pops up not allowing the installation to continue. had a quick look on other forums and the general concensus is that the settings that need changing are deep in the technical parts of the computer which im not prepared to go to. has anyone else had any problems like this and is there an easy way to fix it!?

    We might as well try something fairly simple, just in case.
    Download a fresh copy of the itunes installer to the Vaio's hard drive. (Don't run the install online.)
    Latest iTunes Installer
    Now start the install by right-clicking on the iTunesSetup.exe file and selecting "run as administrator".
    Does that install go through any easier?

  • I get message saying system administrator has set policies to prevent this installation; when trying to uninstall message says you do not have sufficient access to uninstall itunes please contact your administrator.  i am administrator.

    when intalling itunes i get message saying system administrator has set policies to prevent this installation; when trying to uninstall message says you do not have sufficient access to uninstall itunes please contact your administrator.  i am the dministrator.

    Windows right?
    Likely your not the administor any more, the botnet is.
    Check on this site really quick if your part of a botnet
    http://botnetchecker.com/
    All clear? Hopefully. Backup your files to a external drive, cd or dvd, USB keye etc off your computer.
    Run the sfx file on this site and it will burn to a cd.
    http://www.avira.com/en/support-download-avira-antivir-rescue-system
    Next hit your BIO's key and set the cd to boot first, run the scanner and see what it pops up.
    If your all clear then create another Admin, transfer your files over from the first Admin.
    See if that works, eventually when your totally over to the new Admin, delete the old one.
    If you can't create a new Admin, find out who locked your machine down, like your parents or it's a school computer?
    Likely installed spyware or "nanyware" to watch you.
    Hope that works.

  • Unable to Log in. Please see your System Administrator. Laptop chucks Spack

    Hi all,
    Got great responses from people in my first post recently, but before I managed to try any of them, my laptop chucked a spack attack.
    It will start up, and get to the Log in Window, but when I type in my password (yes, it is the right one...) I get a message which says something like, 'There is a Problem logging in. Please see your System Administrator'. I can't remember the exact wording, but it is pretty much that.
    Unfortunately, I am the System Administrator, and I'm using the only log in and password attached to the computer. So I've got no idea how to get into it. A friend suggested I start it up in target disk mode from another computer, but I've got Filevault turned on, so I suspect I'm going to have the same problem.
    Recently installed an Apple security Update, but thats the only thing that has changed.
    Any suggestions very welcome, as it has been about five days now.
    Thanks,
    Jonathan

    Hi Jonathan!
    Have you tried resetting the Admin PW?
    To reset the administrator password using the Mac OS X CD:
    1. Insert the Mac OS X Install Disc 1 CD and restart the computer.
    2. When you hear the startup tone, hold down the C key until you see the spinning gear.
    3. When the Installer appears, choose Installer > Reset Password.
    4. Follow the onscreen instructions to change the password.
    5. Quit the Installer and restart your computer while holding down the mouse button to eject the CD.
    Copied From Changing your administrator password
    Good Luck!
    ali b

  • Cannot delete login item "You cannot change this item because it's managed by your system administrator"

    We migrated a server (ldap and file serving) to some new machines, which have new names.  We've got all of the login and file sharing functionality working on the new machines, but wherever we have a mount of a share in the Login Items for a user, we can't get the old machine out of the Login Items.  It's not fatal, but it does make login take a lot longer because it has to fail first.
    We can mount the share from the new server, and save THAT in a NEW Login Item just fine -- it's just that when you click on the old defunct one the minus sign is greyed out, and the mouseover says "You cannot change this item because it's managed by your system administrator."  There is a yellow triangle next to the item in the list.  Went into the user's ~/Library/Preferences/com.apple.loginitems.plist and it's not in the file.  The /Library/Preferences don't have anything that looks like a plist of the right name.
    Where do I find it and how do I get rid of it?

    In response to ManishBhatt94's post today, I may have some information that may be useful to you. I called Microsoft's 800-642-7676 and spoke with a technical representative with questions pertaining to my particular issue. I also have friend that has the
    same issue with her computer running windows 8. A representative from my ISP told me how to go into 1)Tools, 2)Internet Options, 3)Connections, 4)LAN settings and uncheck the proxy settings box. However after restarting or shutting down my computer it reappears.
    It will also reappears while I play games on Facebook not allowing me continue until I go back into the proxy settings in LAN and uncheck the box AGAIN and AGAIN. A local owner of a computer repair shop told my friend that it was a virus. After speaking with
    Microsoft today I was told the same thing/it was more than likely a virus on my personal PC at home. As most people likely do,  I use wireless internet in my home on the affected computer. Solution; as suggested by Microsoft rep was to have the virus
    professionally removed either by someone or to use their remote service for a fee of $149 which comes with several guarantees and does not require you to re-install software or documents. I hope that my response was of some help to you. I also kept trying
    to fix this problem but wasted a lot of time. He also suggested to Google the proxy problem to see if ANYONE has any alternatives to fixing this problem!
     

  • Safe mode did not start successfully. This page has encountered a critical error. Contact your system administrator if this problem persists.

    Hi
    I just now updated dec 2013 c.u to sharepoint server 2010 sp2
     I get this error in event viewer when I browse  web applications  , they not open even
    Load control template file /_controltemplates/TaxonomyPicker.ascx failed: Could not load type 'Microsoft.SharePoint.Portal.WebControls.TaxonomyPicker' from assembly 'Microsoft.SharePoint.Portal, Version=14.0.0.0, Culture=neutral, PublicKeyToken=71e9bce111e9429c'.
    SharePoint Web Services Round Robin Service Load Balancer Event: EndpointFailure
    Process Name: OWSTIMER
    Process ID: 3836
    AppDomain Name: DefaultDomain
    AppDomain ID: 1
    Service Application Uri: urn:schemas-microsoft-com:sharepoint:service:548f72e6a39f401e95e92711aea13c45#authority=urn:uuid:9aebe976322541d280e4bd3799fa283f&authority=https://spfwf01:32844/Topology/topology.svc
    Active Endpoints: 2
    Failed Endpoints:1
    Safe mode did not start successfully. This page has encountered a critical error. Contact your system administrator if this problem persists.
    adil

    This messge I get initially I get two times (1)
    SharePoint Web Services Round Robin Service Load Balancer Event: EndpointFailure
    Process Name: w3wp
    Process ID: 4600
    AppDomain Name: /LM/W3SVC/2141356646/ROOT-1-130405218187772398
    AppDomain ID: 2
    Service Application Uri: urn:schemas-microsoft-com:sharepoint:service:548f72e6a39f401e95e92711aea13c45#authority=urn:uuid:9aebe976322541d280e4bd3799fa283f&authority=https://spfwf01:32844/Topology/topology.svc
    Active Endpoints: 2
    Failed Endpoints:1
    Affected Endpoint: http://spfapp02:32843/548f72e6a39f401e95e92711aea13c45/MetadataWebService.svc
    aftert this message three times  (2)
    The Managed Metadata Service 'Managed Metadata Service' is inaccessible.
    and after (3)
    The health service has removed some items from the send queue for management group "MOJOmanagement" since it exceeded the maximum allowed size of 15 megabytes.
    after (4)
    Safe mode did not start successfully. This page has encountered a critical error. Contact your system administrator if this problem persists.
    and this time   I seen I am unable to browse web applications
    and
    Load control template file /_controltemplates/TaxonomyPicker.ascx failed: Could not load type 'Microsoft.SharePoint.Portal.WebControls.TaxonomyPicker' from assembly 'Microsoft.SharePoint.Portal, Version=14.0.0.0, Culture=neutral, PublicKeyToken=71e9bce111e9429c'.
    adil

  • SCCM and ForeFront Endpoint Protection point site system role

    Thanks for looking at this......I am working with SCCM 2012, and ForeFront Endpoint Protection has been set up as an Endpoint Protection point site system role.  Up to now we just haven't had to mess with it much, it just has worked.  I
    have been busy packaging applications for the eager public. I have one pc that has had the Endpoint client self destruct.  Had to remove it via the control panel.  I next did a machine policy retrieval and evaluation cycle (among others) and sccm
    shows that it is aware that this particular machine needs FEP. It lists it as "To Be Installed".  How long will this take?  I have things set for "as soon as possible".   Am I at the mercy of Sccm?  Also, is there
    a way to force the install?  Thanks for any light you can shed on this!

    This will depend on your SCCM client policy settings to allow SCEP installation outside of maintenance windows (if you have any).
    It will also depend if you are using 2 hour deployment "randomizer" option in your SCCM client policy.
    Lastly, you can install it with BITS that have already been downloaded with SCCM client install.
    c:\windows\ccmsetup\scepintall.exe

  • Server encountered unrecoverable error. Please contact your system administrator.

    I need help with this error, I try to sign in with my BB Curve 8520 Windows Live Messenger but it throws this message: "Server encountered unrecoverable error. Please contact your system administrator".
    What could it be? I would appreciate any help.

    Could be an error on the email server, over which you have no control.
    For the time being, to see if this will fix itself, do a reboot: With the BlackBerry device POWERED ON, remove the battery for a minute, and then reinsert the battery to reboot.
    1. If any post helps you please click the below the post(s) that helped you.
    2. Please resolve your thread by marking the post "Solution?" which solved it for you!
    3. Install free BlackBerry Protect today for backups of contacts and data.
    4. Guide to Unlocking your BlackBerry & Unlock Codes
    Join our BBM Channels (Beta)
    BlackBerry Support Forums Channel
    PIN: C0001B7B4   Display/Scan Bar Code
    Knowledge Base Updates
    PIN: C0005A9AA   Display/Scan Bar Code

  • The Data Received from the server running AD RMS didn't match the expected format.contact your system administrator for further investigation.

    Hi All,
       We Have implemented AD RMS in our organisation recently.But the Problem we are facing here many users those are Ms office 2013 we will get the error"The Data Received from the server running AD RMS didn't match the expected format.contact
    your system administrator for further investigation." and those who are in Ms office 2010 Professional it says  
        "The service is Temporally unavailable.Ensure the you have   connectivity to this server.This error could be caused if you are working offline.Proxy setting are preventing your connection or intermittent network issue."
      Below are the workaround did,
    1.Able to reach to Our pipeline ADRMS cluster.
    2.We have a valid Certificate.
    3.if we type https://adrms.ourdomain.com its working fine.
    4.Manually put the registry setting for effected computers.
    5. Applied the Hotfixes:MicrosoftFixit50903,KB2627273.
       Kindly help or suggest us to resolve the above issue as many computers in domain are not working with IRM.
    Thanks and reqard,
    Mohammed Siddiq.

    Hi Mohammed,
    Were you able to fix the issue with CRL disablement?
    Did my post help you or make you laugh? Don't forget to click the Helpful vote :) If I answered your question please mark my post as an Answer.

  • Excel Web Access(An error has occurred.Please contact your system administrator if this problem persists. )

    I'm using share point 2007 under windows server 2008 R2(one web server, another db server).When I publish a excel(*.xlsx) to report library or view it in web browser with the same error as bellows:
    Excel Web Access
    An error has occurred.
    Please contact your system administrator if this problem persists.
    Please kindly support to guide how to fix it with bellow information in details such as log.Many thanks!
    1. The 12/logs file is as bellows:
    10/10/2014 09:53:55.18  w3wp.exe (0x6528)                        0x5C08 Excel Services               
     Excel Calculation Services     2u7d Medium   ExcelServerSharedWebApplication.Local: An exception was thrown by configdb infrastructure: System.InvalidOperationException: ExcelServerSharedWebApplication.Local: Could
    not get ServerContext.Current, which indicates that either SharePoint or the SSP infrastructure isn't provisioned correctly or that we're running outside of a web context.     at Microsoft.Office.Excel.Server.ExcelServerSharedWebApplication.get_Local(). 
    10/10/2014 09:53:55.18  w3wp.exe (0x6528)                        0x5C08 Excel Services               
     Excel Services Administration  8tqh Critical Excel Services: Unexpected exception while trying to access Shared Services Database;. Error = ExcelServerSharedWebApplication.Local: Could not get ServerContext.Current, which indicates that
    either SharePoint or the SSP infrastructure isn't provisioned correctly or that we're running outside of a web context.. 
    10/10/2014 09:53:55.18  w3wp.exe (0x6528)                        0x5C08 Excel Services               
     Excel Web Access               6nfi Unexpected InternalEwr.OpenWorkbook - An unexpected exception in the ECS Proxy occurred. Message: Microsoft.Office.Excel.Server.ExcelServerSettingException:
    An error has occurred. ---> System.InvalidOperationException: ExcelServerSharedWebApplication.Local: Could not get ServerContext.Current, which indicates that either SharePoint or the SSP infrastructure isn't provisioned correctly or that we're running
    outside of a web context.     at Microsoft.Office.Excel.Server.ExcelServerSharedWebApplication.get_Local()     --- End of inner exception stack trace ---     at Microsoft.Office.Excel.Server.ExcelServerSharedWebApplication.get_Local()    
    at Microsoft.Office.Excel.Server.ExcelServerSettings.get_Settings()     at Microsoft.Office.Excel.Server.ExcelServerSettings.get_EcsList()     at Microsoft.Office... 
    2.the event in event viewer is:
    Log Name:      Security
    Source:        Microsoft-Windows-Security-Auditing
    Date:          2014/10/10 9:49:43
    Event ID:      4625
    Task Category: Logon
    Level:         Information
    Keywords:      Audit Failure
    User:          N/A
    Computer:      ***.net
    Description:
    An account failed to log on.
    Subject:
     Security ID:  NULL SID
     Account Name:  -
     Account Domain:  -
     Logon ID:  0x0
    Logon Type:   3
    Account For Which Logon Failed:
     Security ID:  NULL SID
     Account Name:  ***
     Account Domain:  ***
    Failure Information:
     Failure Reason:  An Error occured during Logon.
     Status:   0xc000006d
     Sub Status:  0x0
    Process Information:
     Caller Process ID: 0x0
     Caller Process Name: -
    Network Information:
     Workstation Name: ***
     Source Network Address: ***
     Source Port:  63664
    Detailed Authentication Information:
     Logon Process:  
     Authentication Package: NTLM
     Transited Services: -
     Package Name (NTLM only): -
     Key Length:  0
    This event is generated when a logon request fails. It is generated on the computer where access was attempted.
    The Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.
    The Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).
    The Process Information fields indicate which account and process on the system requested the logon.
    The Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.
    The authentication information fields provide detailed information about this specific logon request.
     - Transited services indicate which intermediate services have participated in this logon request.
     - Package name indicates which sub-protocol was used among the NTLM protocols.
     - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
    Event Xml:
    <Event xmlns="">
      <System>
        <Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-A5BA-3E3B0328C30D}" />
        <EventID>4625</EventID>
        <Version>0</Version>
        <Level>0</Level>
        <Task>12544</Task>
        <Opcode>0</Opcode>
        <Keywords>0x8010000000000000</Keywords>
        <TimeCreated SystemTime="2014-10-10T01:49:43.563436300Z" />
        <EventRecordID>37602685</EventRecordID>
        <Correlation />
        <Execution ProcessID="532" ThreadID="26096" />
        <Channel>Security</Channel>
        <Computer>***.net</Computer>
        <Security />
      </System>
      <EventData>
        <Data Name="SubjectUserSid">S-1-0-0</Data>
        <Data Name="SubjectUserName">-</Data>
        <Data Name="SubjectDomainName">-</Data>
        <Data Name="SubjectLogonId">0x0</Data>
        <Data Name="TargetUserSid">S-1-0-0</Data>
        <Data Name="TargetUserName">***</Data>
        <Data Name="TargetDomainName">***</Data>
        <Data Name="Status">0xc000006d</Data>
        <Data Name="FailureReason">%%2304</Data>
        <Data Name="SubStatus">0x0</Data>
        <Data Name="LogonType">3</Data>
        <Data Name="LogonProcessName">
        </Data>
        <Data Name="AuthenticationPackageName">NTLM</Data>
        <Data Name="WorkstationName">***</Data>
        <Data Name="TransmittedServices">-</Data>
        <Data Name="LmPackageName">-</Data>
        <Data Name="KeyLength">0</Data>
        <Data Name="ProcessId">0x0</Data>
        <Data Name="ProcessName">-</Data>
        <Data Name="IpAddress">***</Data>
        <Data Name="IpPort">63664</Data>
      </EventData>
    </Event>

    Hi Tracy,
    Have you changed something on your SharePoint 2007 environment recently before this issue occurred?
    This issue may be related to Alternate Access Mappings settings like the following similar post, if you have configured AAM, you can check if this issue happened to some URLs, if it's the case, please add the problematic URLs as a Publish URLs for the default
    zone for your web application, and also add these URLs as trusted locations, then check results again.
    If above doesn't work, please enable ULS log on verbose level to get more useful log errors which time are corresponding to the errors occur. 
    https://social.technet.microsoft.com/Forums/en-US/c9ab4818-65c9-444d-be50-1bfed1f1509b/excel-web-access-web-part-works-on-intranet-but-not-internet?forum=sharepointgenerallegacy
    http://blog.bugrapostaci.com/2011/09/08/how-to-enable-verbose-log-mode-on-moss-2007/
    Thanks
    Daniel Yang
    TechNet Community Support

Maybe you are looking for