At one of our client locations, we have recently upgraded our log analysis solutions. Thanks to the reporting, its now become apparent that we are running in to an issue between a terminal server and a report server. The TS server (TS-01) appears
to be trying to access the report server (RPT-01) several times an hour with the event id: 4625, sub-status is 0xC0000133. The event ID relates to a failed-logon attempt obviously, but does not list a username/account ID.. It does list the source address
which is that of the Terminal Server (TS-01), so there is an issue there. The sub status relates to a time sync error between the DC and computer, but both servers are synced with the primary DC (AD). If it helps, AD/PDC is running Windows Server
2008 R2, the Terminal Server is running Windows 2008 R2, and the Report Server is running Windows 2008 Standard. What could be causing these failed logon attempts with no user listed?? Any help is greatly appreciated!!
↧