Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

On my Windows 8.1 desktop, I see a lot of messages like this from lsass.exe in the Event Viewer's audit log:

An attempt was made to query the existence of a blank password for an account.

Subject:
    Security ID:        LOCAL SERVICE
    Account Name:       LOCAL SERVICE
    Account Domain:     NT AUTHORITY
    Logon ID:       0x3E5

Additional Information:
    Caller Workstation: PETTER
    Target Account Name:    Administrator
    Target Account Domain:  PETTER

It goes on once in a while for a few different Target Account Names, like Administrator, Guest, HomeGroupUser$. etc. This message shows up on certain intervals no matter if I am connected to the Internet or not.

To make sure that there were no malicious intent behind this, I did also perform a virus check with Malwarebytes, Trend Micro and AVG which were all in agreement that the system in fact was clean.

I then reinstalled a clean system, still the messages re-appeared after a while.

It does not seem to matter wheter system is connected to network or not, even with network cable unplugged, these messages appear. (Maybe not so strange considering it running as S-1-5-19 "Local Service").

Strangely, on the Internet, there seems to be a lot of others who've faced this very issue, but the threads and questions there remain unanswered.

What is the origin of these messages, and why is there a constant scan for empty passwords?

Here is the output of auditpol:

C:\WINDOWS\system32>auditpol /get /user:Administrator /category:*
No audit policy is defined for the user account.

C:\WINDOWS\system32>auditpol /get /category:*
System audit policy
Category/Subcategory                      Setting
System
  Security System Extension               No Auditing
  System Integrity                        Success and Failure
  IPsec Driver                            No Auditing
  Other System Events                     Success and Failure
  Security State Change                   Success
Logon/Logoff
  Logon                                   Success
  Logoff                                  Success
  Account Lockout                         Success
  IPsec Main Mode                         No Auditing
  IPsec Quick Mode                        No Auditing
  IPsec Extended Mode                     No Auditing
  Special Logon                           Success
  Other Logon/Logoff Events               No Auditing
  Network Policy Server                   Success and Failure
  User / Device Claims                    No Auditing
Object Access
  File System                             No Auditing
  Registry                                No Auditing
  Kernel Object                           No Auditing
  SAM                                     No Auditing
  Certification Services                  No Auditing
  Application Generated                   No Auditing
  Handle Manipulation                     No Auditing
  File Share                              No Auditing
  Filtering Platform Packet Drop          No Auditing
  Filtering Platform Connection           No Auditing
  Other Object Access Events              No Auditing
  Detailed File Share                     No Auditing
  Removable Storage                       No Auditing
  Central Policy Staging                  No Auditing
Privilege Use
  Non Sensitive Privilege Use             No Auditing
  Other Privilege Use Events              No Auditing
  Sensitive Privilege Use                 No Auditing
Detailed Tracking
  Process Creation                        No Auditing
  Process Termination                     No Auditing
  DPAPI Activity                          No Auditing
  RPC Events                              No Auditing
Policy Change
  Authentication Policy Change            Success
  Authorization Policy Change             No Auditing
  MPSSVC Rule-Level Policy Change         No Auditing
  Filtering Platform Policy Change        No Auditing
  Other Policy Change Events              No Auditing
  Audit Policy Change                     Success
Account Management
  User Account Management                 Success
  Computer Account Management             No Auditing
  Security Group Management               Success
  Distribution Group Management           No Auditing
  Application Group Management            No Auditing
  Other Account Management Events         No Auditing
DS Access
  Directory Service Changes               No Auditing
  Directory Service Replication           No Auditing
  Detailed Directory Service Replication  No Auditing
  Directory Service Access                No Auditing
Account Logon
  Kerberos Service Ticket Operations      No Auditing
  Other Account Logon Events              No Auditing
  Kerberos Authentication Service         No Auditing
  Credential Validation                   No Auditing
share|improve this question
    
What is the question here? –  Pro Backup Jun 29 at 14:28
    
What is the origin of these messages, and why is there a constant scan for empty passwords? –  Petter H Jun 29 at 14:32
    
It looks like a security audit. Open a command prompt as administrator, type the following command, and press Enter: auditpol /get /user:Administrator /category:* Then post here the output. –  and31415 Jun 29 at 14:46
    
The User Account Management category is probably the culprit. Make a backup of the audit policies by running this command: auditpol /backup /file:%userprofile%\Desktop\auditpol.bak Ensure the file was saved correctly, then clear all audits: auditpol /clear Restart Windows and check whether you're still getting the same event. –  and31415 Jun 29 at 15:18
    
You are right! That answers the question! It even did say that the source was security auditing. I'd just finished reading Daemon(TM) and so I got freakt out about these messages, but now i am calm once more. Thanks! –  Petter H Jun 29 at 15:52

1 Answer 1

up vote 1 down vote accepted

Security audits

Security auditing is a powerful tool to help maintain the security of an enterprise. Auditing can be used for a variety of purposes, including forensic analysis, regulatory compliance, monitoring user activity, and troubleshooting.

You can use Windows security and system logs to create a security events tracking system, to record and store network activities that are associated with potentially harmful behaviors, and to mitigate those risks.

Source: Security Auditing Overview

Security audits are divided into different categories, such as registry and file system access, failed logon attempts, and user accounts changes. Certain categories are enabled by default. To get a list of the available ones you can run the following command from an elevated command prompt:

auditpol /get /category:*

Event 4797

Here's what a typical event looks like:

Log Name:      Security
Source:        Microsoft-Windows-Security-Auditing
Date:          6/29/2014 10:39:58 AM
Event ID:      4797
Task Category: User Account Management
Level:         Information
Keywords:      Audit Success
User:          N/A
Computer:      <ComputerName>
Description:
An attempt was made to query the existence of a blank password for an account.

Subject:
    Security ID:        LOCAL SERVICE
    Account Name:       LOCAL SERVICE
    Account Domain:     NT AUTHORITY
    Logon ID:           0x3E5

Additional Information:
    Caller Workstation:     <ComputerName>
    Target Account Name:    Administrator
    Target Account Domain:  <DomainName>

As you can see, the category is User Account Management, which generates audit events related to user accounts. Unlike others, this specific event doesn't seem to be documented.

Disable all audit policies

To confirm whether the built-in security auditing feature is the culprit, you can temporarily clear all audit policies, thus disabling them.

  1. Open an elevated command prompt.

  2. Make a backup of the audit policies by running this command:

    auditpol /backup /file:"%userprofile%\Desktop\auditpol.bak"
    

    Ensure the file was saved correctly. It should be located on the desktop. In case it's not, pick a different file path and try again.

  3. Disable all audit policies:

    auditpol /clear
    
  4. Restart Windows, and check whether you're still getting the same events. To restore the policy backup you created earlier, run this command:

    auditpol /restore /file:"%userprofile%\Desktop\auditpol.bak"
    

Further reading

share|improve this answer
    
But the question remains. "An attempt was made to query the existence of a blank password for an account." Who attempted to query the existance of a blank password for an account? I see this answer explains how to disable these security-auditing events. But who is generating them? Where is the IP address of the person who tried to login as me with no password? –  Ian Boyd Dec 9 at 1:54

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.