We have a Windows 2012 R2 RDS server and a Windows 2008 R2 Domain Controller.
Every time a user logs on or off of the RDS server, It logs event 4771 audit failure incorrect username or password for the machine account of the RDS server on the DC. The RDS Server is otherwise working correctly it is just causing an issue with auditing user account failures.
Kerberos pre-authentication failed. Account Information: Security ID: DOMAIN\RDS$ Account Name: RDS$ Service Information: Service Name: krbtgt/DOMAIN Network Information: Client Address: ::ffff:10.0.0.10 Client Port: 53391 Additional Information: Ticket Options: 0x40810010 Failure Code: 0x18 Pre-Authentication Type: 2
How can I identify the cause of the event being logged?
Update: this only happens if I connect to the server by RDP, local login does not cause this event to be logged.
On the RDS server after a RDP login the following event is logged 8 times,
An account failed to log on. Subject: Security ID: NULL SID Account Name: - Account Domain: - Logon ID: 0x0 Logon Type: 3 Account For Which Logon Failed: Security ID: NULL SID Account Name: RDS Account Domain: DOMAIN Failure Information: Failure Reason: Unknown user name or bad password. Status: 0xC000006D Sub Status: 0xC0000064 Process Information: Caller Process ID: 0x0 Caller Process Name: - Network Information: Workstation Name: RDS Source Network Address: ::1 Source Port: 63089 Detailed Authentication Information: Logon Process: NtLmSsp Authentication Package: NTLM Transited Services: - Package Name (NTLM only): - Key Length: 0