Windows 10: High Authentication Failures

Hi Team,


I am observing huge authentication failures(4625, 4776) on my domain controllers. Authentication failures are coming from the local account in the workstations.

Multiple machines are trying to authenticate to DC using this local account and obviously as the local account is not configured on DC, it will get authentication failures. The count is very high near to 1000 in a day from multiple workstations.


Brief about local account: Our internal team is using this local account to add new machines to the domain. After adding machines to the domain, this local account becomes useless.


Why is workstation trying to authenticate to DC using local account?

How can we fix this problem?


Raw payload:

AgentDevice=WindowsLog
AgentLogFile=Security
PluginVersion=7.2.5.27
Source=Microsoft-Windows-Security-Auditing
Computer=XXXXXXXXX

OriginatingComputer=XXXXXXXXXXX
User=
Domain=
EventID=4625
EventIDCode=4625
EventType=16
EventCategory=12544
Level=0
Keywords=0
Task=0
Opcode=0

Message=An account failed to log on.

Subject:
Security ID: NULL SID
Account Name: -
Account Domain: -
Logon ID: 0x0
Logon Type: 3

Account For Which Logon Failed:
Security ID: NULL SID
Account Name: localuser
Account Domain: mylaptop

Failure Information:
Failure Reason: Unknown user name or bad password.
Status: 0xc000006d
Sub Status: 0xc0000064

Process Information:
Caller Process ID: 0x0
Caller Process Name: -
Network Information:
Workstation Name: mylaptop
Source Network Address: 10.1.32.2.23
Source Port: 61905

Detailed Authentication Information:
Logon Process: NtLmSsp
Authentication Package: NTLM
Transited Services: - Package Name (NTLM only): - Key Length: 0

:)

 

Mystery Notification of authentication failure


Whenever I am on my PC (WIN10) I get periodic popup notifications of a login error due to authentication failure. I am not in Gmail nor have I given permission for any Apps to log in. But I still keep getting authentication failure messages from Gmail or some other agent -- a real nuisance that occurs at random about every 5 minutes or so. How can I stop these? *Huh

 

Authenticator Error - You have entered too many invalid codes

Thank you bill24557 for your contribution,

I suggest you turn off the Two step authenticator, then update your account information on
https://account.live.com also uninstall the app.

Once you've done the steps turn on the Two step authenticator again and install the app.

Kindest Regards,

 

Microsoft Account authentication

After more research, I have found my answer. It looks like the issue was that Microsoft released a new Microsoft Authenticator app with the features first introduced in Microsoft Authenticator Beta. The new app received a prompt to approve access to my Microsoft
Account when signing on from a new PC, though I find it strange that the beta app wasn't directly upgraded to the new version of the app.

Microsoft now has three 2 step authentication apps available in the store for Windows 10 Mobile:

• Authenticator - original app from Windows Phone 8
• Microsoft Authenticator Beta - originally released to Windows 10 users when Windows 10 Mobile was only available on the Windows Insider program.
• Microsoft Authenticator - the official Windows 10 app no longer in beta