I have a Windows Server 2008 with a folder shared. When i try to access the shared folder from within the network i get this Audit Failure:

An account failed to log on.

    Security ID:        NULL SID
    Account Name:       -
    Account Domain:     -
    Logon ID:       0x0

Logon Type:         3

Account For Which Logon Failed:
    Security ID:        NULL SID
    Account Name:       laurentiu
    Account Domain:     WIN-CS9MB57MU5H

Failure Information:
    Failure Reason:     An Error occured during Logon.
    Status:         0xc000006d
    Sub Status:     0x0

Process Information:
    Caller Process ID:  0x0
    Caller Process Name:    -

Network Information:
    Workstation Name:   WIN-CS9MB57MU5H
    Source Network Address: 13.211.*.*
    Source Port:        49198

Detailed Authentication Information:
    Logon Process:      
    Authentication Package: NTLM
    Transited Services: -
    Package Name (NTLM only):   -
    Key Length:     0

- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
  <Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-A5BA-3E3B0328C30D}" /> 
  <TimeCreated SystemTime="2018-11-02T10:16:34.478335100Z" /> 
  <Correlation /> 
  <Execution ProcessID="680" ThreadID="728" /> 
  <Security /> 
- <EventData>
  <Data Name="SubjectUserSid">S-1-0-0</Data> 
  <Data Name="SubjectUserName">-</Data> 
  <Data Name="SubjectDomainName">-</Data> 
  <Data Name="SubjectLogonId">0x0</Data> 
  <Data Name="TargetUserSid">S-1-0-0</Data> 
  <Data Name="TargetUserName">laurentiu</Data> 
  <Data Name="TargetDomainName">WIN-CS9MB57MU5H</Data> 
  <Data Name="Status">0xc000006d</Data> 
  <Data Name="FailureReason">%%2304</Data> 
  <Data Name="SubStatus">0x0</Data> 
  <Data Name="LogonType">3</Data> 
  <Data Name="LogonProcessName" /> 
  <Data Name="AuthenticationPackageName">NTLM</Data> 
  <Data Name="WorkstationName">WIN-CS9MB57MU5H</Data> 
  <Data Name="TransmittedServices">-</Data> 
  <Data Name="LmPackageName">-</Data> 
  <Data Name="KeyLength">0</Data> 
  <Data Name="ProcessId">0x0</Data> 
  <Data Name="ProcessName">-</Data> 
  <Data Name="IpAddress">13.211.*.*</Data> 
  <Data Name="IpPort">49198</Data> 

Machine is up to date, credentials 100% valid, even with Administrator not working.

Does any one have any idea how i can make this work?

  • Does client and server have the correct date / time? Nov 2, 2018 at 11:36

1 Answer 1


Make sure the computer is correctly joined to the domain, and not using local credential.

In the audit:

Account Domain: WIN-CS9MB57MU5H

In the audit for the source:

Workstation Name: WIN-CS9MB57MU5H

As you can see it use a local account. If you are in a workgroup it's a normal behavior, but that would mean that the user laurentiu need to be created on that remote machine with the same credential.

  • 1
    I wanted to access the share from the same computer :). Problem was solved by adding the registry "BackConnectionHostNames" with the ip in the field value, under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0 Nov 5, 2018 at 8:17

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .