Audit logon failures Server 2012 R2

hello all,

we have multiple servers different customers have multiple login failures. see below details. 

log name:      security
source:        microsoft-windows-security-auditing
date:          10-11-2014 16:57:17
event id:      4625
task category: logon
level:         information
keywords:      audit failure
user:          n/a
computer:    ******* (servername.domain)
description:
an account failed log on.

subject:
security id: system
account name: *******$(servername)
account domain: ******** (domain name)
logon id: 0x3e7

logon type: 3

account logon failed:
security id: null sid
account name:
account domain:

failure information:
failure reason: unknown user name or bad password.
status: 0xc000006d
sub status: 0xc0000064

process information:
caller process id: 0x244
caller process name: c:\windows\system32\lsass.exe

network information:
workstation name: *********(servername)
source network address: -
source port: -

detailed authentication information:
logon process: schannel
authentication package: kerberos
transited services: -
package name (ntlm only): -
key length: 0

this event generated when logon request fails. generated on computer access attempted.

the subject fields indicate account on local system requested logon. commonly service such server service, or local process such winlogon.exe or services.exe.

the logon type field indicates kind of logon requested. common types 2 (interactive) , 3 (network).

the process information fields indicate account , process on system requested logon.

the network information fields indicate remote logon request originated. workstation name not available , may left blank in cases.

the authentication information fields provide detailed information specific logon request.
- transited services indicate intermediate services have participated in logon request.
- package name indicates sub-protocol used among ntlm protocols.
- key length indicates length of generated session key. 0 if no session key requested.

al servers logon failures dc's , of them essential servers. after extensive troubleshooting found out lsass,exe trying query registry item isn’t there?! <o:p></o:p>

i used process monitor check action performed lsass on audit failures. lsass trying regqueryvalue on hklm\software\microsoft\windows nt\currentversion\winlogon\forceautolockonlogon. result = name not found. witch correct when check registry because key isn’t there…. when google key nothing comes up… may presume bug on windows end? , how can end these audit failures?<o:p></o:p>

any appreciated! <o:p></o:p>

hello!

i experienced same thing adfs 3.0-setup , know if else have figured out...

Windows Server  >  Windows Server 2012 General