im a part security monitoring team
Many guest failed login attempts are triggered in our environment
while in my investigation,
Eventcode 4625 with a subject AccountName=John account name for logon failed:Guest
i found that the succesfull logon [logon_type 10] by john causes the guest failed attempt
does anyone know that causes this type of guest login???
Message=An account failed to log on.
Subject: Security ID: S-1-5-21-654654654-987897-3284891205-17372 Account Name: john Account Domain: mydomain Logon ID: 0x68aa2c86
Logon Type: 3
Account For Which Logon Failed: Security ID: S-1-0-0 Account Name: Guest Account Domain: hok-01
Failure Information: Failure Reason: Account currently disabled. Status: 0xc000006e Sub Status: 0xc0000072
Process Information: Caller Process ID: 0x335c Caller Process Name: C:\Windows\explorer.exe
Network Information: Workstation Name: hok-01 Source Network Address: - Source Port: -
Detailed Authentication Information:
Logon Process: Advapi
Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): -
Key Length: 0
please let me know any further details required.
thanks in advance :)