Event 4648 does not have information for me to investigate

hi everyone, i've been trying find source of login failures(almost 8000) coming server , haven't found anything. have searched batch files, looked in task scheduler, nothing. there tools can use or other places can try , find source of these login failures? event isn't helping me because isn't displaying process name, missing here?

there shouldn't relationship between server , exchange server trying authenticate to. i've checked exchange server logs , found port 0. help/advice appreciated.

logon attempted using explicit credentials.

subject:
security id: system
account name: system
account domain: nt authority
logon id: 0x1dca8712
logon guid: {00000000-0000-0000-0000-000000000000}

account credentials used:
account name: laster1a
account domain: nas
logon guid: {00000000-0000-0000-0000-000000000000}

target server:
target server name: exchange1.nas.local
additional information: exchange1.nas.local

process information:
process id: 0x4
process name:

network information:
network address: -
port: -

event generated when process attempts log on account explicitly specifying account’s credentials.  this commonly occurs in batch-type configurations such scheduled tasks, or when using runas command.

hi wade,

thanks posting, event log posted here caused following issues:

• a user connects server or runs program locally using alternate credentials.  instance user maps drive server specifies different user's credentials or opens shortcut under runas shift-control-right-clicking on shortcut, selecting run as..., , filling in different user's credentials in dialog box appears.  or user logs on web site using new specific credentials. 
• this event logged when process logs on different account such when scheduled tasks service starts task specified user. logged on user: specifies original user account.
• with user account control enabled, end user runs program requiring admin authority.  event process information consent.exe.  unfortunately subject not identify end user.

you can check above ways , start investigate.

best regards,

elaine 

---

please remember mark replies answers if , unmark them if provide no help. if have feedback technet subscriber support, contact tnmff@microsoft.com.

Windows Server  >  Security