Windows 10: Failed logon event generated by Veeam ONE on Windows computers

Having the issue, listed at this site: https://www.veeam.com/kb2276Which brings me to https://support.microsoft.com/en-us/help/2816192/failed-logon-event-generated-when-running-remote-wmi-command However, the article states: "Applies to: Windows 7 Service Pack 1, Windows Server 2012 R2"I'm trying to verify if this is accurate, or if the documentation needs to be updated.If it does need to be updated, does it also encompass Windows 11 and Windows Server 2025?If yes, helps find a resolution to the problem.If not, well then I guess I'm SOL haha.I would love Windows support, howev

:)

 

Events 4672 & 4624 Win 10 Freezes - special LOGON ?

Hi,

Thank you for writing to Microsoft Community Forums.

1. Are you on a domain network?
   
2. May I know the make and the model number of your system?
   

The event logs you have provided seems to be the security logs that is generated when you login to your system. For more information on the event that was generated, you can check
4672(S): Special privileges assigned to new logon.

The Windows error logs will be located at Event Viewer > Windows Logs > System.

Please follow the step below and check if it works for you.

Step: Improve Windows 10 Performance.

Try some of the following suggestions to help
make your Windows 10 PC run better. The steps are listed in order, so start with the first one, see if that fixes the problem, and then continue to the next one if it doesn’t.

Note: The last step on the article contains Windows Reset, I suggest you not to perform Windows reset, as there is a change your data and applications will be wiped and also
the OS will reverted back to previous version you upgraded from.

If the issue still persists, please reply to this post with more information so that we can identify the root cause of this issue and assist you further.

Hope it helps.

Amit Sunar

Microsoft Community – Moderator

 

Understanding about Audit Logon Event

Hi

Welcome to Microsoft community.

The Audit Logon events in the Windows Event Log are generated by the operating system to track user logon and logoff activities on a system. These events can provide valuable information about who is accessing the system and when. However, it's essential to understand that these events can also be generated by various system processes, services, and background tasks, not just by physical user logins.

Here are some common scenarios where you might see duplicate login/logout events and Kerberos Ticket requests in the Event Log, even when there's no physical user logging into the client machine:

1. Scheduled Tasks: Some scheduled tasks or background processes may require authentication and generate logon events, even when no user is interacting with the machine. These tasks could include maintenance tasks, background updates, and other system-related activities.
   
2. Service Accounts: System services, applications, or tasks running under service accounts might trigger logon events for those accounts without involving physical users. Service accounts are often used to run various services in the background.
   
3. Network Access: If the system is accessed remotely via network shares or other network resources, logon events might be generated for that remote access, even if no user is directly interacting with the machine.
   
4. Cached Credentials: In some cases, cached credentials might be used to access network resources, which can lead to logon events, even if no fresh user authentication occurs.
   
5. Kerberos Ticket Renewal: Kerberos is the authentication protocol used in Windows environments. When a user logs in, a Kerberos Ticket is generated, and it may be automatically renewed by the system without requiring the user to log in again.
   
6. Terminal Services or Remote Desktop Services: In environments with remote desktop or terminal services enabled, logon events might be triggered for remote sessions.
   

To better understand the specific cause of the duplicate logon events in your environment, it's recommended to analyze the Event Log in more detail. Check the event IDs associated with the logon and logoff activities and look for information about the type of logon (e.g., interactive, network, batch, service, etc.), the user account involved, the source of the logon (e.g., Service, Network, LogonUI, etc.), and any associated IP addresses.

Remember that logs can vary depending on the system configuration and the applications running.

Please feel free to let me know if you have any further updates, thanks.

Best regards

Derrick Qian | Microsoft Community Support Specialist

 

Veeam backups failing since 1803 install with 0x80042306 VSS timeout error

On desktop machine here, post 1803 update, Veeam backups are repeatably failing. Associated event viewer information:

Veeam Agent 'Backup Job DIYNUC' finished with Failed.

Job details: Creating VSS snapshot Error: Failed to create snapshot: Backup job failed.

Cannot create a shadow copy of the volumes containing writer's data.

VSS asynchronous operation is not completed. Operation: [Shadow copies commit]. Code: [0x80042306].

Error: Failed to create snapshot: Backup job failed.

Cannot create a shadow copy of the volumes containing writer's data.

VSS asynchronous operation is not completed. Operation: [Shadow copies commit]. Code: [0x80042306].

The shadow copy of volume \\?\Volume{0e1a4bd5-2758-4ab6-a00c-05bc7333610a} being created failed to install.

Volume Shadow Copy Service error: Unexpected error DeviceIoControl(\\?\Volume{0e1a4bd5-2758-4ab6-a00c-05bc7333610a} - 000000000000021C,0x0053c008,000001DDF8C0A6B0,0,000001DDF8C0B6E0,4096,[0]). hr = 0x80070079, The semaphore timeout period has expired.

This was working for months before 1803 installation. And works on my 1803 laptop.

Any suggestions?