Windows 10: Event 4625 on a personal computer

Hi,


I've asked here before about the event 4625 that kept showing up daily on my Event Viewer at nearly the same time every day, and, while I didn't get much help, I managed to partially "fix" this issue by changing my local IP address, which somehow made this event stop popping up. However, after a brief pause, I'm now getting a new variant of Event 4625 on my Event Viewer:


Log Name: Security

Source: Microsoft-Windows-Security-Auditing

Date: 9/9/2019 9:58:02 PM

Event ID: 4625

Task Category: Logon

Level: Information

Keywords: Audit Failure

User: N/A

Computer: SKELETOR

Description:

An account failed to log on.



Subject:

Security ID: SKELETOR\Pichau

Account Name: Pichau

Account Domain: SKELETOR

Logon ID: 0x6BF80



Logon Type: 3



Account For Which Logon Failed:

Security ID: NULL SID

Account Name: Convidado

Account Domain: SKELETOR



Failure Information:

Failure Reason: Account currently disabled.

Status: 0xC000006E

Sub Status: 0xC0000072



Process Information:

Caller Process ID: 0x1424

Caller Process Name: C:\Windows\explorer.exe



Network Information:

Workstation Name: SKELETOR

Source Network Address: -

Source Port: -



Detailed Authentication Information:

Logon Process: Advapi

Authentication Package: Negotiate

Transited Services: -

Package Name (NTLM only): -

Key Length: 0



Now, it seems explorer.exe is trying to log into my disabled Guest account, much like how my own IP(?) was trying to do the same thing before. This seems like a random occurrence - it happened three times one day, then it stopped happening for two full days, then happened once today. My question is: is this something I should be worried about? I've already ran three different malware/virus scans and couldn't find anything (my first suspicion was that this could be a virus/hacking attempt since a few months ago a family member managed to install a shady software on my machine, but I've gotten rid of it a long time ago and even used a Restore Point), and my computer seems to behave normally - I have no crashes, no freezes, nothing abnormal. I'm only a bit worried because this Event seems to be associated with Windows Servers/file sharing, but I don't even have Network Discovery turned on, and I'm just a regular Windows user. I've already read a lot about this Event, but I'm still unable to understand why it would happen on my personal computer. I've also tried repairing Windows and running chkdsk. I'm really worried about this and would appreciate any help.

:)

 

Event 4625 keeps happening every day at (nearly) the same time

Hi,



Thank you for writing to Microsoft Community Forums.



I understand that you are getting the Event ID 4625 on your PC at a specific time.



I have been researching on this and found some information which might be helpful for you. You can refer the article

4625(F): An account failed to log on



However, as you have mentioned that the Event ID is getting triggered at a particular time there are possibilities that a task is being executed at that time interval. I would suggest you to check the task scheduler and see if any task is executed
at that time.

1. Press Windows + S key together and type
   Task Scheduler.
   
2. Now on the left hand pane click on Task Scheduler (local).
   
3. Now under Task Status select the drop down for
   Last 24 hours/Last hour and check if any task is executing at
   1 PM.
   

Please get back to us with the detailed information to assist you further.



We await your response.



Regards,

Prakhar Khare

Microsoft Community – Moderator

 

Event 4625 keeps happening every day at (nearly) the same time

One more thing (sorry for all the questions!) - I've been researching this event a bit more and I found

this solution on several different pages. Many people suggest that this event can be triggered by a "stale hidden credential". This reminded me I've changed my Windows account password some days ago,
and now I'm starting to wonder if this could be related to my issue. The people in these pages suggest that deleting the saved credentials can fix this issue. I've checked my computer's Credentials Manager and it seems I have quite a few saved passwords (my
old password is probably still in there somewhere). Would it be safe for me to delete these to see if this could fix my issue?

 

Windows 10 infinite restart black screen

Thank you john for all of your help i decided to get the usb my computer came with and factory reset it i didnt have anything that personal or valueable so its ok thanks for the help though i appreciate it