Security Audit Failures in Event Viewer Windows Server 2008R2

Posted by Jacob on Server Fault See other posts from Server Fault or by Jacob
Published on 2013-07-30T21:42:53Z Indexed on 2014/06/13 15:27 UTC
Read the original article Hit count: 300

Filed under:

windows-server-2008-r2

|

eventviewer

When I am looking at the security tab of my event viewer on a Windows Server 2008 R2, I am showing a ton of Audit Failures with Event ID 4776.

The computer attempted to validate the credentials for an account.

Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:  randy
Source Workstation: HPDB1
Error Code: 0xc0000064

I verified the account "randy" exist in my Active Directory. From my understanding, there has not been any recent password changes. Is there any way to get detailed information on this error? I am wondering what program is requesting this information.

Also, is there any way to clear this error up? I was thinking about resetting the password and changing it back to the original.

© Server Fault or respective owner

Related posts about windows-server-2008-r2

Cannot enable network discovery on Windows Server 2008 R2

as seen on Server Fault - Search for 'Server Fault'
I'm trying to enable the Network Discovery feature on a newly installed Windows Server 2008 R2 instance. The network connection is in the Home or Work profile (it is not domain joined). These are the steps I've followed: Within the Network and Sharing Center I select Change advanced sharing settings Then… >>> More
Windows Server 2008 R2: AD Module for Windows PowerShell

as seen on Internet.com - Search for 'Internet.com'
Windows Server 2008 R2 includes a new Active Directory module for Windows PowerShell, a consolidated group of 76 cmdlets that can perform a host of tasks against Active Directory's various services. >>> More
Windows Server 2008 R2: Introducing the AD Administrative Center

as seen on Internet.com - Search for 'Internet.com'
The Active Directory Administrative Center in Windows Server 2008 R2 is a significant improvement over its predecessor. Although not without limitations, it offers beefed-up management of AD objects, new navigation capabilities, better task-based management options, and improvements to the properties… >>> More
Sun Fire X4270 M3 SAP Enhancement Package 4 for SAP ERP 6.0 (Unicode) Two-Tier Standard Sales and Distribution (SD) Benchmark

as seen on Oracle Blogs - Search for 'Oracle Blogs'
Oracle's Sun Fire X4270 M3 server achieved 8,320 SAP SD Benchmark users running SAP enhancement package 4 for SAP ERP 6.0 with unicode software using Oracle Database 11g and Oracle Solaris 10. The Sun Fire X4270 M3 server using Oracle Database 11g and Oracle Solaris 10… >>> More
Now Customers Can Actually Locate Your Resources with URL Rewriter 2.0 RTW

as seen on ASP.net Weblogs - Search for 'ASP.net Weblogs'
Today, Microsoft announced the final release of IIS URL Rewriter 2.0 RTW . Now the first reason might be obvious why you would want to rewrite a URL – when you are at a cocktail party with loud music and tasty appetizers and a potential customer asks you where they can get more info on your snazzy… >>> More

Related posts about eventviewer

Unknown and strange RDP successful logins in EventViewer

as seen on Server Fault - Search for 'Server Fault'
I have a Windows Server 2008 R2 with a valid IP, and recently I've found hundreds of unknown and strange RDP successful logins logged in EventViewer. Here are some details: They are not similar to normal logins, they happen like every second in a while even when I myself am logged in to the server… >>> More
How can I view a .evt file saved with the Event viewer of another computer?

as seen on Server Fault - Search for 'Server Fault'
I have a .evt file saved with the EventViewer of another computer. I think I can use my computer's EventViewer as long as I have the same version of the OS. Are there any other alternatives? >>> More
How can I view a .evt file saved with the Event viewer of another computer?

as seen on Stack Overflow - Search for 'Stack Overflow'
I have a .evt file saved with the EventViewer of another computer. I think I can use my computer's EventViewer as long as I have the same version of the OS. Are there any other alternatives? >>> More
Event 4098, 0x80070533 Logon failure: account currently disabled?

as seen on Server Fault - Search for 'Server Fault'
Having started to upgrade our PCs to Windows 7 we have noticed that we are getting group policy warnings in Event Viewer such as: "The user 'Word.qat' preference item in the 'a_Office2007_Users {A084A37B-6D4C-41C0-8AF7-B891B87FC53B}' Group Policy object did not apply because it failed with error… >>> More
Event 36888 : The following fatal alert was generated: 10. The internal error state is 1203

as seen on Server Fault - Search for 'Server Fault'
I search on the Internet, but i am unable to find, Why this error is coming? It has flooded my Event Viewer, after interval of 1 minutes, this Error pops-up. ( means the frequency is 1 minutes ) I didn't have any IIS installed. This server is purely Domain controller and no other role has been… >>> More