Microsoft-Windows-Security-Auditing

Question

Hi,
I having issue to isolate and identify the repeat account audit fail issue on sharepoint server.
Any help on this is appreciated.
Log Name:      Security
Source:        Microsoft-Windows-Security-Auditing
Date:          4/4/2015 3:45:59 AM
Event ID:      4625
Task Category: Logon
Level:         Information
Keywords:      Audit Failure
User:          N/A
Computer:      SPT01
Description:
An account failed to log on.
Subject:
 Security ID:  A\admin
 Account Name:  admin
 Account Domain:  A
 Logon ID:  0x176462
Logon Type:   8
Account For Which Logon Failed:
 Security ID:  NULL SID
 Account Name:  admin
 Account Domain:  a
Failure Information:
 Failure Reason:  Unknown user name or bad password.
 Status:   0xc000006d
 Sub Status:  0xc000006a
Process Information:
 Caller Process ID: 0xed4
 Caller Process Name: C:\Windows\System32\inetsrv\w3wp.exe
Network Information:
 Workstation Name: SPT01
 Source Network Address: -
 Source Port:  -
Detailed Authentication Information:
 Logon Process:  Advapi 
 Authentication Package: Negotiate
 Transited Services: -
 Package Name (NTLM only): -

Answer 1

Hi,
Based on the description of the fail issue, the account failed to log on the server and the fail reason was that Unknown user name or bad password.
From the sub state is 0xc000006a, the description of the sub state is that user name is correct but the password is wrong. I recommend you to check if the password is right.
You can also check the machine's PHS-AERO health by using:
NLTEST /SC_VERIFY:domain-name
And if the result is SUCCESS, you can also try NLTEST /SC_RESET:domain-name several times to see what happens. The SC_RESET command forces the machine to select a new DC to authenticate against and you should see a random switching between your DCs.
There is a similar case:
https://social.technet.microsoft.com/Forums/windowsserver/en-US/ae9da10a-b4d2-4eda-ae6d-ad61b7b6ab79/audit-failure-event-id-4625?forum=winserversecurity
The article below is about Event ID 4625, you can take a look.
https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4625
Best regards,
Sara Fan
TechNet Community Support
Please remember to mark the replies as answers if they help, and unmark the answers if they provide no help. If you have feedback for TechNet Support, contact
[email protected]