Hi Guys,
We have been getting 4776 Events (status with 0xc0000064)on our IIS server stating that the account does not exists for multiple users.
But AD accounts is actually exists and not issues with AD accounts as well.
In Same server I can see Successful logon events for same users, don't understand why its happening
Please help me on this...
Successful logon event 4624 for same user account on same server
An account was successfully logged on.
Subject:
Security ID:
NULL SID
Account Name:
-
Account Domain:
-
Logon ID:
0x0
Logon Type:
3
New Logon:
Security ID:
xxxxxxxxxxx
Account Name:
xxxxxxxxxxx
Account Domain:
xxxxxxxxxxx
Logon ID:
0x2d7af6a6e
Logon GUID:
{00000000-0000-0000-0000-000000000000}
Process Information:
Process ID:
0x0
Process Name:
-
Network Information:
Workstation Name:
xxxxxxxxxxxx
Source Network Address: xx.xx.xx.xx
Source Port:
58480
Detailed Authentication Information:
Logon Process:
NtLmSsp
Authentication Package:
NTLM
Transited Services:
-
Package Name (NTLM only):
NTLM V2
Key Length:
0
This event is generated when a logon session is created. It is generated on the computer that was accessed.
The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the
Server service, or a local process such as Winlogon.exe or Services.exe.
The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).
The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.
The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank
in some cases.
The authentication information fields provide detailed information about this specific logon request.
- Logon GUID is a unique identifier that
can be used to correlate this event with a KDC event.
- Transited services indicate which intermediate
services have participated in this logon request.
- Package name indicates which sub-protocol
was used among the NTLM protocols.
- Key length indicates the length of the
generated session key. This will be 0 if no session key was requested.