Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have received lots of failure audits on my server. From the log, I have identified the particular machine that is the culprit. How can I identify which process is sending the login request?

Do you have any idea how to find out?

Below is the detail of the log.

Security log on \QKSRVDC212:

[2465151] Microsoft-Windows-Security-Auditing

    Type:     FAILURE AUDIT 


    Time:     7/26/2012 9:31:00 AM   ID:       4625 

An account failed to log on.
    Security ID:        S-1-0-0
    Account Name:       -
    Account Domain:     -
    Logon ID:       0x0
  Logon Type:           3

  Account For Which Logon Failed:
    Security ID:        S-1-0-0
    Account Name:       Quality
    Account Domain:     QDMNT140

  Failure Information:
    Failure Reason:     Unknown user name or bad password.
    Status:         0xc000006d
    Sub Status:     0xc0000064

  Process Information:
    Caller Process ID:  0x0
    Caller Process Name:    -

  Network Information:
    Workstation Name:   QDMNT140
    Source Network Address:
    Source Port:        3973

  Detailed Authentication Information:
    Logon Process:      NtLmSsp 
    Authentication Package: NTLM
    Transited Services: -
    Package Name (NTLM only):   -
    Key Length:     0
share|improve this question

On the login source system 'QDMNT140' use netstat -ano | findstr 3973 to see which process has the matching source port '3973' open. Replace 3973 with whatever the port changes to if it's not static.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.