I have an issue with event id 4625. Hope you can help me to fix it. I have a Hyper V Cluster whit 6 hosts(2016). On several of my hosts every day I am found alert "Security-Event ID: 4625". Sometimes the "Source Network Address:" is one of my nodes, and sometimes null.
Example:
Problem started at 19:30:14 on 2021.10.16
Problem name: Event ID4625 alert - Logon Failure
Severity: High
Operational data: An account failed to log on.
Subject:
Security ID: S-1-0-0
Account Name: -
Account Domain: -
Logon ID: 0x0
Logon Type: 3
Account For Which Logon Failed:
Security ID: S-1-0-0
Account Name:
Account Domain:
Failure Information:
Failure Reason: An Error occured during Logon.
Status: 0x80090308
Sub Status: 0x0
Process Information:
Caller Process ID: 0x0
Caller Process Name: -
Network Information:
Workstation Name: -
Source Network Address: X.X.X.X (IP address one off nodes from the cluster)
Source Port: 54096
Detailed Authentication Information:
Logon Process:
Authentication Package: NTLM
Transited Services: -
Package Name (NTLM only): -
Key Length: 0
BR Aleksei
