ITsVISTA
Information that makes life easier when it comes to installing, managing, and using Windows Vista.
Start About FAQ Blogroll Shop

ITsVISTA KB-Link: KB2549079

Local user accounts incorrectly trigger domain account logon auditing events when they view history of scheduled tasks in Windows Vista or in Windows Server 2008

Consider the following scenario:

  • You enable the following audit policies in a domain:
    • Audit account logon events
    • Audit logon events
  • You join a computer that is running Windows Vista or Windows Server 2008 to the domain.
  • You log on to the computer by using a local user account.
  • You refresh the history of a scheduled task in Task Scheduler on the computer.

In this scenario, the following two security events are incorrectly logged in the Security log on a domain controller:

Log Name: Security
Source: Microsoft-Windows-Security-Auditing
Date: [date & time]
Event ID: 4625
Task Category: Logon
Level: Information
Keywords: Audit Failure
User: N/A
Computer: [computer name]
Description:
An account failed to log on.
Subject:
Security ID: NULL SID
Account Name: –
Account Domain: –
Logon ID: 0×0
Logon Type: 3
Account For Which Logon Failed:
Security ID: NULL SID
Account Name: [account name]
Account Domain: [domain name]
Failure Information:
Failure Reason: Unknown user name or bad password.
Status: 0xc000006d
Sub Status: 0xc000006a

Log Name: Security
Source: Microsoft-Windows-Security-Auditing
Date: [date & time]
Event ID: 4776
Task Category: Credential Validation
Level: Information
Keywords: Audit Failure
User: N/A
Computer: [computer name]
Description:
The domain controller attempted to validate the credentials for an account.
Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account: [account name]
Source Workstation: [name]
Error Code: 0xc000006a

Note: If a domain user has the same name as the local user account, the domain user account is locked if the local user account refreshes the history of a scheduled task many times.

There is a download that resolves this issue. See Hotfixes for details.
32-bit Download: Contact Microsoft
64-Bit Download: Contact Microsoft

For more information on this issue, including potential causes, workarounds, and resolutions, see: Microsoft KB Article KB2549079.

Get notified of new posts for FREE via RSS or E-mail

Subscribe to ITsVISTA!

Related Posts