49 Replies Latest reply on Jul 12, 2013 6:28 PM by solarwolf

    Audit Failure errors

    SolarWinds Community Team

       

      I thought the created user for the EminentWare service only needed logon as a service on the local box permissions yet it seems as if it is trying to logon across the network to a computer in which case it would need those additional permissions. What am I missing here?

      I have been getting 2 audit failure errors when trying to do any kind of update management on any pc. The errors are:

      1.

      Event Type: Failure Audit
      Event Source: Security
      Event Category: Account Logon
      Event ID: 680
      Date: xxxxxxx
      Time: xxxxxxx
      User: NT AUTHORITY\SYSTEM
      Computer: Network workstation
      Description: 
      Logon attempt by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
      Logon Account: [color=red:ceee0e24d3][b:ceee0e24d3]ewdgssvc-25957[/b:ceee0e24d3][/color:ceee0e24d3]
      Source Workstation: WSUS\EminentWare server
      Error Code: 0xC0000064

      2.

      Event Type: Failure Audit
      Event Source: Security
      Event Category: Logon/Logoff
      Event ID: 529
      Date: xxxxxx
      Time: xxxxxx
      User: NT AUTHORITY\SYSTEM
      Computer: Network workstation
      Description:
      Logon Failure:
      Reason: Unknown user name or bad password
      User Name: [color=red:ceee0e24d3][b:ceee0e24d3]ewdgssvc-25957[/b:ceee0e24d3][/color:ceee0e24d3]
      Domain: WSUS\EminentWare server
      Logon Type: 3
      Logon Process: NtLmSsp
      Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
      Workstation Name: WSUS\EminentWare server

      Thanks,
      Richard