Windows 10: Guest account fail logon

Dears,I have this log, I did every search possible without any chance to solve, anyone have any idea how to solve,The LOG from Event viewer, An account failed to log on. Subject: Security ID: "Domain"\John.saw Account Name: &

:)

 

Account failed logon 4625 on VM guest when clicking the entry of VM guest on failover cluster Manager on VM Host

Issue:

We found a multiple failed logon events on VM guest (evert ID 4625) with account (the account you logon on VM host) when we clicking the entry of VM guest on failover cluster manager console on VM host with Integration servers (Data Exchange) is enabled.



How to reproduce:

1. Check the “Data Exchange” is enabled on a VM guest (Enabled by default, right?)
2. Open Failover Cluster Manager Console on VM host.
3. Click the VM guest entry
4. Then you may found multiple failed logon events on that VM guest.

Reference:

Hyper-V Integration Services



Question:

1. Does the multiple failed logons are normal or necessary?
2. If the failed logons are normal and necessary to be happened and the “Data exchange” function is good to be enabled to gather data from VM guest, any recommendation for us to correct or avoid these failed logon?

Please advise.



Constrain:

We have no chance to use same account and password on VM hosts and VM guests (because all account are managed by password management) and the Audit Policy of Audit Credential Validation must be enabled.

 

Guest account fail logon

I have this log

...

Event Type

UserLogonFailure

• EventInfo
  
  Logon Failure ""my machine name"\Guest"
  
• DetectionIP
  
  "FQDN of my machine"
  
• ToolAlias
  
  Windows Security
  
• ProviderSID
  
  Microsoft-Windows-Security-Auditing 4625
  
• LogonProcess
  
  Advapi
  
• InsertionTime
  
  2022-12-20 16:08:50
  
• Manager
  
  swi-sem
  
• SourceDomain
  
  YBSERVICE
  
• DetectionTime
  
  2022-12-20 16:08:48
  
• ExtraneousInfo
  
  SourcePort: -; Call-ProcessName: C:\Windows\explorer.exe;
  
• DestinationAccount
  
  Guest
  
• DestinationMachine
  
  "FQDN of my machine"
  
• AuthPackage
  
  Negotiate
  
• FailureCount
  
  1
  
• DestinationDomain
  
  "my machine name"
  
• SourceAccount
  
  "My account name"
  
• LogonType
  
  Windows: Network
  
• Severity
  
  4
  
• SourceLogonID
  
  0xe7ec7
  
• FailureReason
  
  Account currently disabled.
  
• InsertionIP
  
  "FQDN of my machine"
  
• ManagerTime
  
  2022-12-20 16:08:50
  
• SourceMachine
  
  "my machine name"
  
  ......................................
  

Anyone this this event before and can mention the root cause.

I checked the event viewer but there is no much information wich application or service caused this log.

 

How to remove Guest account?


Try these steps and you should be able to delete the guest account:

1. Press the WIN + X keys and select "Command Prompt (Admin)" from the Quick Access menu.
2. At the Command Prompt, run this command: Code:
   
   Code:

   net user Guest /del