1

I have been trying to wrap my head around this for a whil, but can't seem to find a solution. I have seen many alike questions here and in other fora, but none match my situation. All other threads have explicit source, account and IP info, but mine doesn't. This is the Event Info that appears approx every half an hour:

An account failed to log on.

Subject:    Security ID:        SYSTEM  Account Name:       CITY2012ESS$    Account Domain:     CITYMAN     Logon ID:       0x3E7
Logon Type:         3
Account For Which Logon Failed:     Security ID:        NULL SID    Account Name:           Account Domain:     
Failure Information:    Failure Reason:     Unknown user name or bad password.  Status:         0xC000006D  Sub Status:     0xC0000064
Process Information:    Caller Process ID:  0x280   Caller Process Name:    C:\Windows\System32\lsass.exe
Network Information:    Workstation Name:   CITY2012ESS     Source Network Address: -   Source Port:        -
Detailed Authentication Information:    Logon Process:      Schannel    Authentication Package: Kerberos    Transited Services: -   Package Name (NTLM only):   -   Key Length:     0

This event is generated when a logon request fails. It is generated on the computer where access was attempted.

As you see there is no account or network info on the source available. That leads me to think that it is happening on the servermachine itself, caused by some service. Worth mentioning is that this server is not reachable from outside internet traffic. There is no exchange on the server, only a AD sync from Office365. So I think the "attack" must be coming from inside the local network, or even inside the local machine.

Can anyone shed some light on this?

0

You must log in to answer this question.

Browse other questions tagged .