Windows Server 2008 Audit Failure Event 4625

hello have many of events, 10 per seconds , 15 minutes.

an account failed log on.    subject:  	security id:		system  	account name:		win-ml7a3vskkvu$  	account domain:		workgroup  	logon id:		0x3e7    logon type:			8    account logon failed:  	security id:		null sid  	account name:		root  	account domain:		    failure information:  	failure reason:		unknown user name or bad password.  	status:			0xc000006d  	sub status:		0xc0000064    process information:  	caller process id:	0x444  	caller process name:	c:\windows\system32\svchost.exe    network information:  	workstation name:	win-ml7a3vskkvu  	source network address:	-  	source port:		-    detailed authentication information:  	logon process:		advapi    	authentication package:	microsoft_authentication_package_v1_0  	transited services:	-  	package name (ntlm only):	-  	key length:		0  

i'm try identify source of problem, have checked services didn't find strange, compared running services other severs , same. thing have found task in windows scheduler windows defender , starts few seconds before audit failures. when start task doesn't generate exception , runs less minute.

thanks

hi,

posting in microsoft technet forums.

please check information in thread below related audit failure event 4625 (unknown user name or bad password):

audit failure event id 4625

http://social.technet.microsoft.com/forums/en-us/winserversecurity/thread/ae9da10a-b4d2-4eda-ae6d-ad61b7b6ab79/

regards

kevin

Windows Server  >  Security