0

i am seeing this error on 3 pcs on the network and on our server, they are coming from 1 account that has been deleted and 2 that are still on the PC's. we are on a regular workgroup network with 2012 server std. we have Changed everybody's passwords recently. No services are using any accounts with passwords we changed. i am seeing this event log every 15 minutes. There are many task's but i dont see any with the user that has been deleted or other 2 users. This has been driving me crazy and i have to disable our account lockout policy since it is locking out 2 accounts on the server side....Any help would be great!?

A logon was attempted using explicit credentials.

Subject: Security ID: NULL SID Account Name: - Account Domain: - Logon ID: 0x14CEB Logon GUID: {00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used: Account Name: Melissa Account Domain: MELISSA-PC Logon GUID: {00000000-0000-0000-0000-000000000000}

Target Server: Target Server Name: SRV2008 Additional Information: SRV2008

Process Information: Process ID: 0x4 Process Name:

Network Information: Network Address: fe80::888:b5b0:27fb:13a0 Port: 445

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.

4
  • I also checked the credential manager and no luck..
    – Renho17
    Aug 2, 2017 at 23:44
  • Remove MELISSA-PC from the workgroup
    – Ramhound
    Aug 2, 2017 at 23:45
  • i am seeing this error - which error? Event 4648 is informational. If there is an event 4624 right after it, it means the logon attempt was successful. Otherwise you will see 4625.
    – Amit Naidu
    Mar 20 at 23:02
  • Port 445 is most likely a hint that old credentials are cached somewhere on a network mapped drive.
    – Amit Naidu
    Mar 20 at 23:05

0

You must log in to answer this question.

Browse other questions tagged .