0

I have a Windows Server 2008 with a folder shared. When i try to access the shared folder from within the network i get this Audit Failure:

An account failed to log on.

Subject:
    Security ID:        NULL SID
    Account Name:       -
    Account Domain:     -
    Logon ID:       0x0

Logon Type:         3

Account For Which Logon Failed:
    Security ID:        NULL SID
    Account Name:       laurentiu
    Account Domain:     WIN-CS9MB57MU5H

Failure Information:
    Failure Reason:     An Error occured during Logon.
    Status:         0xc000006d
    Sub Status:     0x0

Process Information:
    Caller Process ID:  0x0
    Caller Process Name:    -

Network Information:
    Workstation Name:   WIN-CS9MB57MU5H
    Source Network Address: 13.211.*.*
    Source Port:        49198

Detailed Authentication Information:
    Logon Process:      
    Authentication Package: NTLM
    Transited Services: -
    Package Name (NTLM only):   -
    Key Length:     0

- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
  <Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-A5BA-3E3B0328C30D}" /> 
  <EventID>4625</EventID> 
  <Version>0</Version> 
  <Level>0</Level> 
  <Task>12544</Task> 
  <Opcode>0</Opcode> 
  <Keywords>0x8010000000000000</Keywords> 
  <TimeCreated SystemTime="2018-11-02T10:16:34.478335100Z" /> 
  <EventRecordID>63334</EventRecordID> 
  <Correlation /> 
  <Execution ProcessID="680" ThreadID="728" /> 
  <Channel>Security</Channel> 
  <Computer>WIN-CS9MB57MU5H</Computer> 
  <Security /> 
  </System>
- <EventData>
  <Data Name="SubjectUserSid">S-1-0-0</Data> 
  <Data Name="SubjectUserName">-</Data> 
  <Data Name="SubjectDomainName">-</Data> 
  <Data Name="SubjectLogonId">0x0</Data> 
  <Data Name="TargetUserSid">S-1-0-0</Data> 
  <Data Name="TargetUserName">laurentiu</Data> 
  <Data Name="TargetDomainName">WIN-CS9MB57MU5H</Data> 
  <Data Name="Status">0xc000006d</Data> 
  <Data Name="FailureReason">%%2304</Data> 
  <Data Name="SubStatus">0x0</Data> 
  <Data Name="LogonType">3</Data> 
  <Data Name="LogonProcessName" /> 
  <Data Name="AuthenticationPackageName">NTLM</Data> 
  <Data Name="WorkstationName">WIN-CS9MB57MU5H</Data> 
  <Data Name="TransmittedServices">-</Data> 
  <Data Name="LmPackageName">-</Data> 
  <Data Name="KeyLength">0</Data> 
  <Data Name="ProcessId">0x0</Data> 
  <Data Name="ProcessName">-</Data> 
  <Data Name="IpAddress">13.211.*.*</Data> 
  <Data Name="IpPort">49198</Data> 
  </EventData>
  </Event>

Machine is up to date, credentials 100% valid, even with Administrator not working.

Does any one have any idea how i can make this work?

  • Does client and server have the correct date / time? – marsh-wiggle Nov 2 '18 at 11:36
0

Make sure the computer is correctly joined to the domain, and not using local credential.

In the audit:

Account Domain: WIN-CS9MB57MU5H

In the audit for the source:

Workstation Name: WIN-CS9MB57MU5H

As you can see it use a local account. If you are in a workgroup it's a normal behavior, but that would mean that the user laurentiu need to be created on that remote machine with the same credential.

  • 1
    I wanted to access the share from the same computer :). Problem was solved by adding the registry "BackConnectionHostNames" with the ip in the field value, under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0 – Laurentiu Lomnasan Nov 5 '18 at 8:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.