Hi Microsoft Expert,
We have receive this event log every 30 + days, when these event log generated it will keep on continue until we have reboot the system. We have check there is no such user call RDS-SH01, this "RDS-SH01" is hostname of one of our server.
The sub status explaination doesn't make sense to us, is it microsoft bug we need to patch or something configure wrongly from our system?
AuthenticationPackageName: NTLMCategory: Logon
Channel: Security
EventID: 4625
EventReceivedTime: 1586414809
EventTime: 2020-04-09 14:46:48
EventType: AUDIT_FAILURE
FailureReason: %%2313
Hostname: RDS-SH01.ABC.LOCAL
IpAddress: ::1
IpPort: 61289
KeyLength: 0
Keywords: -9218868437227405000
LmPackageName: -
LogonProcessName: NtLmSsp
LogonType: 3
Message: An account failed to log on.
Subject:
Security ID:S-1-0-0
Account Name:-
Account Domain:-
Logon ID:0x0
Logon Type:3
Account For Which Logon Failed:
Security ID:S-1-0-0
Account Name:RDS-SH01
Account Domain:ABC
Failure Information:
Failure Reason:Unknown user name or bad password.
Status:0xC000006D
Sub Status:0xC0000064
Process Information:
Caller Process ID:0x0
Caller Process Name:-
Network Information:
Workstation Name:RDS-SH01
Source Network Address:::1
Source Port:61289
Detailed Authentication Information:
Logon Process:NtLmSsp
Authentication Package:NTLM
Transited Services:-
Package Name (NTLM only):-
Key Length:0
Regards,
Shiro