Windows 10: 4625 Event ID shows own pc name as the account name and security ID on Null SID

Can anyone shed light as I'm getting the error below, on a pattern, every 7 PM daily and 8 AM weekly on one of our *servers ?. No scripts running, and no task/s scheduled to run. I do get that it is coming somewhere remotely as it has a logon type of 3 but the IP is coming from itself. We got tons of notifications about this one, but the only value changing is the source port and everything else is constant.Have already enabled NTLM Auditing and didn’t show much information. Please see NTLM Log.Where/what else can I check to get this sorted out? An account failed to log on.&n

:)

 

Mysterious event IDs 4723 and 4625

I have not made any changes to any passwords. This is followed by an audit failure event 4625. This happens a couple times every time I log in and then stops.

Can any one help me figure out what is going on? Thank you

 

Event ID 4625 with the account login blank. Network Source ::1

Hello, on my windows server 2012, we keep getting Event ID 4625 with the account login blank however the network source is ::1 which is a loop back address.

Anyone came across this before? How do I get rid of these events?

An account failed to log on.

Subject:

Logon Type: 3

Account For Which Logon Failed:

Failure Information:

Process Information:

Network Information:

Detailed Authentication Information:

This event is generated when a logon request fails. It is generated on the computer where access was attempted.

The Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).

The Process Information fields indicate which account and process on the system requested the logon.

The Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The authentication information fields provide detailed information about this specific logon request.

 

Event 4625 keeps happening every day at (nearly) the same time

Hi, thanks for your reply. I've updated to Windows 1903 overnight and uninstalled some unused programs hoping it would fix the problem, but unfortunately it's still happening. I've checked Task Scheduler as you've suggested but the Task Status Window is
completely blank (0 running, 0 succeeded, 0 stopped, 0 failed) no matter which time interval I select. I tried checking the Task Scheduler Library and the closest I could find was 'GoogleUpdateTaskMachineUA' - apparently it ran at 1:21 PM, and Event Viewer
shows 2 Event 4625 at 1:28 PM. I should also mention this - these events always happen around 1 PM, but they're never at the exact same time and always happen a few minutes later on the following day. For example, it happened at 1:18 PM yesterday, and today
it happened at 1:28 PM.

I don't think 'GoogleUpdateTaskMachineUA' is causing this, mostly because it seems to run multiple times per day (every 1 hour, according to Task Manager) and the 4625 logs only show up at one given time. Is there some way for me to find what tasks/processes/etc
are connecting to a specific port? The 4625 logs always show a different source port:

Log Name: Security

Source: Microsoft-Windows-Security-Auditing

Date: 30-Aug-19 1:28:28 PM

Event ID: 4625

Task Category: Logon

Level: Information

Keywords: Audit Failure

User: N/A

Computer: SKELETOR

Description:

An account failed to log on.

Subject:

Security ID: NULL SID

Account Name: -

Account Domain: -

Logon ID: 0x0

Logon Type: 3

Account For Which Logon Failed:

Security ID: NULL SID

Account Name: guest

Account Domain:

Failure Information:

Failure Reason: Unknown user name or bad password.

Status: 0xC000006D

Sub Status: 0xC0000064

Process Information:

Caller Process ID: 0x0

Caller Process Name: -

Network Information:

Workstation Name: \\(my ip)

Source Network Address: (my ip)

Source Port: 64511

Detailed Authentication Information:

Logon Process: NtLmSsp

Authentication Package: NTLM

Transited Services: -

Package Name (NTLM only): -

Key Length: 0

This time, it used 64511 and 64503 as its source ports on the two logon attempts. My computer seems to be behaving normally but I'm really concerned about the possibility of someone spying on me in some way because of these logs. I was really hoping that
updating to 1903 would fix it in some way.

EDIT: It just happened a second time at 1:55 PM. Again, two attempts, separated by roughly 5 seconds each. This is the log for one of them:

Log Name: Security

Source: Microsoft-Windows-Security-Auditing

Date: 30-Aug-19 1:55:31 PM

Event ID: 4625

Task Category: Logon

Level: Information

Keywords: Audit Failure

User: N/A

Computer: SKELETOR

Description:

An account failed to log on.

Subject:

Security ID: NULL SID

Account Name: -

Account Domain: -

Logon ID: 0x0

Logon Type: 3

Account For Which Logon Failed:

Security ID: NULL SID

Account Name: guest

Account Domain:

Failure Information:

Failure Reason: Unknown user name or bad password.

Status: 0xC000006D

Sub Status: 0xC0000064

Process Information:

Caller Process ID: 0x0

Caller Process Name: -

Network Information:

Workstation Name: \\ (my ip)

Source Network Address: (my ip)

Source Port: 64663

Detailed Authentication Information:

Logon Process: NtLmSsp

Authentication Package: NTLM

Transited Services: -

Package Name (NTLM only): -

Key Length: 0

I've checked Task Scheduler a second time and couldn't find anything that happened during this time. GoogleUpdateTaskMachineUA didn't run a second time, so I don't think it has anything to do with this task.

Second edit: not sure if it's relevant/could be related, but I have a few 'gupdate' errors in my Event Log, and, after doing some research, they have something to do with Google Updates? I don't think GoogleUpdateTaskMachineUA is related to my issue but
then again I don't understand much about these logs! Let me know if you have something specific in mind for me to check. I'd also like to know if you think these might be attempts from someone at hacking my computer, or something less dangerous (I've read
a lot about Event 4625 but since I'm not running a server, I don't really understand how someone else would be able to request logon to my machine). I ran several malware/virus scans only a short while ago and couldn't find anything suspicious or unusual,
and I have Windows Firewall enabled as well. The "Network Information" area shows my own IP address (and the Event Log explains that it shows where the logon attempt came from), so I'm assuming these logon attempts are coming from my own computer rather than
someone else's. Is this correct?