We have a Windows 2012 R2 RDS server and a Windows 2008 R2 Domain Controller.

Every time a user logs on or off of the RDS server, It logs event 4771 audit failure incorrect username or password for the machine account of the RDS server on the DC. The RDS Server is otherwise working correctly it is just causing an issue with auditing user account failures.

Kerberos pre-authentication failed.

Account Information:
Security ID:        DOMAIN\RDS$
Account Name:       RDS$

Service Information:
Service Name:       krbtgt/DOMAIN

Network Information:
Client Address:     ::ffff:
Client Port:        53391

Additional Information:
Ticket Options:     0x40810010
Failure Code:       0x18
Pre-Authentication Type:    2

How can I identify the cause of the event being logged?

Update: this only happens if I connect to the server by RDP, local login does not cause this event to be logged.

On the RDS server after a RDP login the following event is logged 8 times,

An account failed to log on.

Security ID:        NULL SID
Account Name:       -
Account Domain:     -
Logon ID:       0x0

Logon Type:         3

Account For Which Logon Failed:
Security ID:        NULL SID
Account Name:       RDS
Account Domain:     DOMAIN

Failure Information:
Failure Reason:     Unknown user name or bad password.
Status:         0xC000006D
Sub Status:     0xC0000064

Process Information:
Caller Process ID:  0x0
Caller Process Name:    -

Network Information:
Workstation Name:   RDS
Source Network Address: ::1
Source Port:        63089

Detailed Authentication Information:
Logon Process:      NtLmSsp 
Authentication Package: NTLM
Transited Services: -
Package Name (NTLM only):   -
Key Length:     0
  • Are you asking a question or making a statement? – joeqwerty Mar 6 '17 at 15:54
  • Sub Status 0xC0000064 (in your second event) means the user name does not exist. I don't know what event ID your 2nd event is, but I see that the Account Name is RDS not RDS$. Is it possible you have a user account (not computer account) named RDS? – Twisty Impersonator Mar 9 '17 at 14:46
  • I've got this same thing - a single server 2012R2 RDS deployment (no hack nonsense, it's part of a domain) - and this 8 simultaneous 4625 is killling my ability to accurately track logon failures. Even stranger, the logged IP is the loopback IPv6 address of the server itself. Quite stumped. – JohnThePro Mar 2 at 1:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.