Windows 10: Authentication Failure

Hi,

I did a fresh install of Windows 10 1903.

I have a single local administrator account.

I have no problem login in to Windows on the computer itself.

But if i try to connect using remote desktop or connect to a shared drive, authentication for the same user always fails.

I tried to update to 1909 but that did not change the behavior.

I tried to create a local user account but authentication fails as well.

I am not sure what i am missing and be thankful for any pointers to fix this.


Thanks,

Amit K.

:)

 

Mystery Notification of authentication failure


Whenever I am on my PC (WIN10) I get periodic popup notifications of a login error due to authentication failure. I am not in Gmail nor have I given permission for any Apps to log in. But I still keep getting authentication failure messages from Gmail or some other agent -- a real nuisance that occurs at random about every 5 minutes or so. How can I stop these? *Huh

 

High Authentication Failures

Hi Team,

I am observing huge authentication failures(4625, 4776) on my domain controllers. Authentication failures are coming from the local account in the workstations.

Multiple machines are trying to authenticate to DC using this local account and obviously as the local account is not configured on DC, it will get authentication failures. The count is very high near to 1000 in a day from multiple workstations.

Brief about local account: Our internal team is using this local account to add new machines to the domain. After adding machines to the domain, this local account becomes useless.

Why is workstation trying to authenticate to DC using local account?

How can we fix this problem?

Raw payload:

AgentDevice=WindowsLog

AgentLogFile=Security

PluginVersion=7.2.5.27

Source=Microsoft-Windows-Security-Auditing

Computer=XXXXXXXXX

OriginatingComputer=XXXXXXXXXXX

User=

Domain=

EventID=4625

EventIDCode=4625

EventType=16

EventCategory=12544

Level=0

Keywords=0

Task=0

Opcode=0

Message=An account failed to log on.

Subject:

Security ID: NULL SID

Account Name: -

Account Domain: -

Logon ID: 0x0

Logon Type: 3

Account For Which Logon Failed:

Security ID: NULL SID

Account Name: localuser

Account Domain: mylaptop

Failure Information:

Failure Reason: Unknown user name or bad password.

Status: 0xc000006d

Sub Status: 0xc0000064

Process Information:

Caller Process ID: 0x0

Caller Process Name: -

Network Information:

Workstation Name: mylaptop

Source Network Address: 10.1.32.2.23

Source Port: 61905

Detailed Authentication Information:

Logon Process: NtLmSsp

Authentication Package: NTLM

Transited Services: - Package Name (NTLM only): - Key Length: 0

 

How To Create Two Factor Authentication for Remote Desktop

Hello artmanphoto, are you using the built in remote software that comes with windows 10 ?
I too use remote software, so can i suggest you change to one of the following.
Because the remote software that comes with windows is very insecure.

Anydesk
To use 2 step authenticator with anydesk go here

Teamviewer
To use 2 step authenticator with teamviewer go here


Splashtop
To use 2 step authenticator with splashtop go here


Radmin
Does not have 2 step authentication as far as i know.
But it does have IP Filter, very high security.

All 4 have very high security,
Anydesk, Splashtop & teamviewer all have so you can add two factor authentication with google authenticator.
Personally i prefer radmin

* Had to add Anydesk to my suggestion because it's just to good to leave out *