Windows Server 2008 Shared Folder Access

Question

I have a Windows Server 2008 with a folder shared. When i try to access the shared folder from within the network i get this Audit Failure:

An account failed to log on.

Subject:
    Security ID:        NULL SID
    Account Name:       -
    Account Domain:     -
    Logon ID:       0x0

Logon Type:         3

Account For Which Logon Failed:
    Security ID:        NULL SID
    Account Name:       laurentiu
    Account Domain:     WIN-CS9MB57MU5H

Failure Information:
    Failure Reason:     An Error occured during Logon.
    Status:         0xc000006d
    Sub Status:     0x0

Process Information:
    Caller Process ID:  0x0
    Caller Process Name:    -

Network Information:
    Workstation Name:   WIN-CS9MB57MU5H
    Source Network Address: 13.211.*.*
    Source Port:        49198

Detailed Authentication Information:
    Logon Process:      
    Authentication Package: NTLM
    Transited Services: -
    Package Name (NTLM only):   -
    Key Length:     0

- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
  <Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-A5BA-3E3B0328C30D}" /> 
  <EventID>4625</EventID> 
  <Version>0</Version> 
  <Level>0</Level> 
  <Task>12544</Task> 
  <Opcode>0</Opcode> 
  <Keywords>0x8010000000000000</Keywords> 
  <TimeCreated SystemTime="2018-11-02T10:16:34.478335100Z" /> 
  <EventRecordID>63334</EventRecordID> 
  <Correlation /> 
  <Execution ProcessID="680" ThreadID="728" /> 
  <Channel>Security</Channel> 
  <Computer>WIN-CS9MB57MU5H</Computer> 
  <Security /> 
  </System>
- <EventData>
  <Data Name="SubjectUserSid">S-1-0-0</Data> 
  <Data Name="SubjectUserName">-</Data> 
  <Data Name="SubjectDomainName">-</Data> 
  <Data Name="SubjectLogonId">0x0</Data> 
  <Data Name="TargetUserSid">S-1-0-0</Data> 
  <Data Name="TargetUserName">laurentiu</Data> 
  <Data Name="TargetDomainName">WIN-CS9MB57MU5H</Data> 
  <Data Name="Status">0xc000006d</Data> 
  <Data Name="FailureReason">%%2304</Data> 
  <Data Name="SubStatus">0x0</Data> 
  <Data Name="LogonType">3</Data> 
  <Data Name="LogonProcessName" /> 
  <Data Name="AuthenticationPackageName">NTLM</Data> 
  <Data Name="WorkstationName">WIN-CS9MB57MU5H</Data> 
  <Data Name="TransmittedServices">-</Data> 
  <Data Name="LmPackageName">-</Data> 
  <Data Name="KeyLength">0</Data> 
  <Data Name="ProcessId">0x0</Data> 
  <Data Name="ProcessName">-</Data> 
  <Data Name="IpAddress">13.211.*.*</Data> 
  <Data Name="IpPort">49198</Data> 
  </EventData>
  </Event>

Machine is up to date, credentials 100% valid, even with Administrator not working.

Does any one have any idea how i can make this work?

Answer 1

Make sure the computer is correctly joined to the domain, and not using local credential.

In the audit:

Account Domain: WIN-CS9MB57MU5H

In the audit for the source:

Workstation Name: WIN-CS9MB57MU5H

As you can see it use a local account. If you are in a workgroup it's a normal behavior, but that would mean that the user laurentiu need to be created on that remote machine with the same credential.