Windows 10: Mysterious event IDs 4723 and 4625

Every time I login into my personal computer, I see an event ID 4723 with a timestamp of few minutes after logging in.

For example, I logged in at 6:01 PM and saw the event logged at 6:03 PM.


The event is as follows:


An attempt was made to change an account's password. Subject: Security ID: SYSTEM Account Name: MyDesktop$ Account Domain: WORKGROUP Logon ID: 0x3E7 Target Account: Security ID: MyDesktop\DefaultAccount Account Name: DefaultAccount Account Domain: MyDesktopAdditional Information: Privileges -



I have not made any changes to any passwords. This is followed by an audit failure event 4625. This happens a couple times every time I log in and then stops.


An account failed to log on.Subject: Security ID: SYSTEM Account Name: MyDesktop$ Account Domain: WORKGROUP Logon ID: 0x3E7Logon Type: 2Account For Which Logon Failed: Security ID: NULL SID Account Name: DefaultAccount Account Domain: MyDesktopFailure Information: Failure Reason: Account currently disabled. Status: 0xC000006E Sub Status: 0xC0000072Process Information: Caller Process ID: 0x190 Caller Process Name: C:\Windows\System32\lsass.exeNetwork Information: Workstation Name: MyDesktop Source Network Address: - Source Port: -Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name NTLM only: - Key Length: 0


Can any one help me figure out what is going on? Thank you

:)

 

Event 4625 keeps happening every day at (nearly) the same time

Hi,



Thank you for writing to Microsoft Community Forums.



I understand that you are getting the Event ID 4625 on your PC at a specific time.



I have been researching on this and found some information which might be helpful for you. You can refer the article

4625(F): An account failed to log on



However, as you have mentioned that the Event ID is getting triggered at a particular time there are possibilities that a task is being executed at that time interval. I would suggest you to check the task scheduler and see if any task is executed
at that time.

1. Press Windows + S key together and type
   Task Scheduler.
   
2. Now on the left hand pane click on Task Scheduler (local).
   
3. Now under Task Status select the drop down for
   Last 24 hours/Last hour and check if any task is executing at
   1 PM.
   

Please get back to us with the detailed information to assist you further.



We await your response.



Regards,

Prakhar Khare

Microsoft Community – Moderator

 

Event 4625 on a personal computer

Hi,

I've asked here before about the
event 4625 that kept showing up daily on my Event Viewer at nearly the same time every day, and, while I didn't get much help, I managed to partially "fix" this issue by changing my local IP address, which somehow made this event stop popping up. However,
after a brief pause, I'm now getting a new variant of Event 4625 on my Event Viewer:

Log Name: Security

Source: Microsoft-Windows-Security-Auditing

Date: 9/9/2019 9:58:02 PM

Event ID: 4625

Task Category: Logon

Level: Information

Keywords: Audit Failure

User: N/A

Computer: SKELETOR

Description:

An account failed to log on.

Subject:

Security ID: SKELETOR\Pichau

Account Name: Pichau

Account Domain: SKELETOR

Logon ID: 0x6BF80

Logon Type: 3

Account For Which Logon Failed:

Security ID: NULL SID

Account Name: Convidado

Account Domain: SKELETOR

Failure Information:

Failure Reason: Account currently disabled.

Status: 0xC000006E

Sub Status: 0xC0000072

Process Information:

Caller Process ID: 0x1424

Caller Process Name: C:\Windows\explorer.exe

Network Information:

Workstation Name: SKELETOR

Source Network Address: -

Source Port: -

Detailed Authentication Information:

Logon Process: Advapi

Authentication Package: Negotiate

Transited Services: -

Package Name (NTLM only): -

Key Length: 0

Now, it seems explorer.exe is trying to log into my disabled Guest account, much like how my own IP(?) was trying to do the same thing before. This seems like a random occurrence - it happened three times one day, then it stopped happening for two full days,
then happened once today. My question is: is this something I should be worried about? I've already ran three different malware/virus scans and couldn't find anything (my first suspicion was that this could be a virus/hacking attempt since a few months ago
a family member managed to install a shady software on my machine, but I've gotten rid of it a long time ago and even used a Restore Point), and my computer seems to behave normally - I have no crashes, no freezes, nothing abnormal. I'm only a bit worried
because this Event seems to be associated with Windows Servers/file sharing, but I don't even have Network Discovery turned on, and I'm just a regular Windows user. I've already read a lot about this Event, but I'm still unable to understand why it would happen
on my personal computer. I've also tried repairing Windows and running chkdsk. I'm really worried about this and would appreciate any help.

 

Event ID 10016, CLSID and APPID

Hey, I've been trying to resolve this same dcom issue myself, and I followed the steps you listed @FreeBooter, but when I try to do the last step, I firstly when clicking "edit" get a message saying



And then when I do enter the menu after clicking "ok" on that dialog box, the add button is greyed out.

I'm 100% certain I followed all the steps correctly. I triple-checked it. But no dice...