A user is complaining about account being locked several times a day
AD/DC = Win2008R2, user PC is Windows7
IT unlock the users and life goes on
Recently we got more than 10 errors in a single day
So we checked the logs, and there are several 4625, 4776 and 4740 events, but the 4625 event ID shows the closest DC to the user, the svchost PID proccess, the basic reason: 0xc000006d (pwd error), a sub status: 0xc000006a and:
Logon Process:CHAP
Logon Type:3
So, for now, we deleted the user profile and also changed the RDP port to avoid potential brute force attacks and so on, until we figure out how to really detect from where the connections attempts are trying to be originated from
As i read, i´m using NLA and therefore should be no info available unless i disable NLA, which i´m not inclined to do change right now because it´s a global RDP policy
So, there is a debug, log, more detailed information in some place?
below, details
Failure Information:Failure Reason:Unknown user name or bad password.
Status: 0xc000006d
Sub Status: 0xc000006a
Process Information:
Caller Process Name:C:\Windows\System32\svchost.exe
Network Information:
Workstation Name:
Source Network Address:-
Source Port: -
Detailed Authentication Information:
Logon Process:CHAP
Authentication Package:MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Transited Services:-
Package Name (NTLM only):-
Key Length: 0