Multiple logon failed 4625 with $ Expand / Collapse
Author
Message
Posted 5/12/2020 4:38:38 AM
Forum Newbie

Forum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum Newbie

Group: Forum Members
Last Login: 5/12/2020 4:28:04 AM
Posts: 1, Visits: 0
Recently we discovered that in some unknown cases windows alerted multiple logon failed 4625. In that cases, the account names ended with $ that means computer account failed.
Also based on our tries, we didn't recognize any problem in communication between active directory and the client side.
My question is: How and why windows generates some 4625 logon failed events while their account name ended with $?
Post #8633
Posted 5/13/2020 7:42:06 AM
Forum Newbie

Forum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum Newbie

Group: Forum Members
Last Login: 5/13/2020 7:38:02 AM
Posts: 2, Visits: 0
I would also like to know the reason too for this kind of behavior. I am a security analyst and would like to understand why this happens. I hope someone with the expertise would shed light on this.
Post #8635
Posted 5/21/2020 7:26:35 PM
Forum Newbie

Forum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum Newbie

Group: Forum Members
Last Login: 5/21/2020 7:05:01 PM
Posts: 2, Visits: 0
Same here. I'm going through the Sec logs on the DC's, and coming across machine names failing their logon.
Failure Information:
Failure Reason: %%2310
Status: 0xc000006e
Sub Status: 0xc0000072
Any body have any insights on this?
Post #8639
« Prev Topic | Next Topic »


Permissions Expand / Collapse

All times are GMT -5:00, Time now is 2:51pm