4625 Event ID shows own pc name as the account name and security ID on Null SID

D

DominicDC

Can anyone shed light as I'm getting the error below, on a pattern, every 7 PM daily and 8 AM weekly on one of our *servers (?). No scripts running, and no task/s scheduled to run. I do get that it is coming somewhere remotely as it has a logon type of 3 but the IP is coming from itself. We got tons of notifications about this one, but the only value changing is the source port and everything else is constant.Have already enabled NTLM Auditing and didn’t show much information. Please see NTLM Log.Where/what else can I check to get this sorted out? An account failed to log on.&n

Continue reading...
 
Back
Top Bottom