Windows Server Audit Failure from Client

Asked Aug 14 '13 at 20:12

Active Aug 14 '13 at 20:52

Viewed 309 times

Every several minutes I get an audit failure from one of my clients running Windows 8 on ports 56280 to 56294 in the event log of my server which provides DHCP/DNS/DC for that client. Do you have any idea what those ports are or how I can find out more about this?

EventID 4625
Task 12544
LogonType 3 
LogonProcessName NtLmSsp  
AuthenticationPackageName NTLM

edited Aug 14 '13 at 20:52

asked Aug 14 '13 at 20:12

Theveloper

whats the event id? – tony roth Aug 14 '13 at 20:47
@tonyroth coming to my rescue again Tony, I edited the question - so an account is failing to logon, how do I find out which one? – Theveloper Aug 14 '13 at 20:55
to get a better indication whats the failure reason, hopefully not account unknown! – tony roth Aug 14 '13 at 20:58
Account For Which Logon Failed: it's actually the account I'm using right now on the client, the failure reason: Unknown user name or bad password. And the logon process: NtLmSsp – Theveloper Aug 14 '13 at 21:23
on the workstation thats trying to connect do a netstat -ano find the pid then find that pid in the task list whats the task? – tony roth Aug 15 '13 at 17:10
@tonyroth Well... it seems to have disappeared, when it comes back, I'll do that. – Theveloper Aug 16 '13 at 05:43

Windows Server Audit Failure from Client

0 Answers0