Failed Logon Event 4625 Expand / Collapse
Author
Message
Posted 11/17/2017 10:41:34 AM
Forum Newbie

Forum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum Newbie

Group: Forum Members
Last Login: 11/17/2017 10:20:10 AM
Posts: 1, Visits: 0
I am running a small network on a Win 2012 Server. It has Exchange on it. Several times a day about 3-4 users continuously get bounced out of outlook because their domain account gets locked out. Same 3-4 people every time. They also loose ability to connect to any other network resources. (ie Shares, apps on other machines, printers). Can sometime id the machine with the 4625 error sometimes it is blank. Looking at the 4740 messages only reveal successful logons....no failures. I have posted the error below. Everything I find tells me how to find errors related to the event however I can't seem to find anything to point me towards the cause. Any assistance would be appreciated.

- System

- Provider

[ Name] Microsoft-Windows-Security-Auditing
[ Guid] {54849625-5478-4994-A5BA-3E3B0328C30D}

EventID 4625

Version 0

Level 0

Task 12546

Opcode 0

Keywords 0x8010000000000000

- TimeCreated

[ SystemTime] 2017-11-17T15:00:50.451211300Z

EventRecordID 252092238

Correlation

- Execution

[ ProcessID] 668
[ ThreadID] 1724

Channel Security

Computer Sledgehammer.ljganwksv1.local

Security


- EventData

SubjectUserSid S-1-0-0
SubjectUserName -
SubjectDomainName -
SubjectLogonId 0x0
TargetUserSid S-1-0-0
TargetUserName Dave
TargetDomainName BLACKSTAR
Status 0xc0000234
FailureReason %%2307
SubStatus 0x0
LogonType 3
LogonProcessName NtLmSsp
AuthenticationPackageName NTLM
WorkstationName BLACKSTAR
TransmittedServices -
LmPackageName -
KeyLength 0
ProcessId 0x0
ProcessName -
IpAddress 192.168.0.8
IpPort 63480


Post #7426
Posted 12/7/2017 4:08:54 PM
Supreme Being

Supreme BeingSupreme BeingSupreme BeingSupreme BeingSupreme BeingSupreme BeingSupreme BeingSupreme Being

Group: Moderators
Last Login: 11/14/2013 3:17:47 PM
Posts: 186, Visits: 0
Could these users have another device that is trying to connect to Exchange with an outdated password?
Post #7429
« Prev Topic | Next Topic »


Permissions Expand / Collapse

All times are GMT -5:00, Time now is 8:07am