Windows 10: Security LOG // Guest account fail logon // Something trying to use Guest account to logon...

Dears,I have this log, I did every search possible without any chance to solve, anyone have any idea how to solve,The LOG from Event viewer, An account failed to log on. Subject: Security ID: "Domain"\John.saw Account Name: &

:)

 

Guest account fail logon

I have this log

...

Event Type

UserLogonFailure

• EventInfo
  
  Logon Failure ""my machine name"\Guest"
  
• DetectionIP
  
  "FQDN of my machine"
  
• ToolAlias
  
  Windows Security
  
• ProviderSID
  
  Microsoft-Windows-Security-Auditing 4625
  
• LogonProcess
  
  Advapi
  
• InsertionTime
  
  2022-12-20 16:08:50
  
• Manager
  
  swi-sem
  
• SourceDomain
  
  YBSERVICE
  
• DetectionTime
  
  2022-12-20 16:08:48
  
• ExtraneousInfo
  
  SourcePort: -; Call-ProcessName: C:\Windows\explorer.exe;
  
• DestinationAccount
  
  Guest
  
• DestinationMachine
  
  "FQDN of my machine"
  
• AuthPackage
  
  Negotiate
  
• FailureCount
  
  1
  
• DestinationDomain
  
  "my machine name"
  
• SourceAccount
  
  "My account name"
  
• LogonType
  
  Windows: Network
  
• Severity
  
  4
  
• SourceLogonID
  
  0xe7ec7
  
• FailureReason
  
  Account currently disabled.
  
• InsertionIP
  
  "FQDN of my machine"
  
• ManagerTime
  
  2022-12-20 16:08:50
  
• SourceMachine
  
  "my machine name"
  
  ......................................
  

Anyone this this event before and can mention the root cause.

I checked the event viewer but there is no much information wich application or service caused this log.

 

Account failed logon 4625 on VM guest when clicking the entry of VM guest on failover cluster Manager on VM Host

Issue:

We found a multiple failed logon events on VM guest (evert ID 4625) with account (the account you logon on VM host) when we clicking the entry of VM guest on failover cluster manager console on VM host with Integration servers (Data Exchange) is enabled.



How to reproduce:

1. Check the “Data Exchange” is enabled on a VM guest (Enabled by default, right?)
2. Open Failover Cluster Manager Console on VM host.
3. Click the VM guest entry
4. Then you may found multiple failed logon events on that VM guest.

Reference:

Hyper-V Integration Services



Question:

1. Does the multiple failed logons are normal or necessary?
2. If the failed logons are normal and necessary to be happened and the “Data exchange” function is good to be enabled to gather data from VM guest, any recommendation for us to correct or avoid these failed logon?

Please advise.



Constrain:

We have no chance to use same account and password on VM hosts and VM guests (because all account are managed by password management) and the Audit Policy of Audit Credential Validation must be enabled.

 

Guest Account in Windows 10

Hello!

2 steps needed to enable Guest account on W10.

Step 1:

Enable it. Try the Computer Management (Right click on the start button), there the Local Users and Groups. There select the Guest account and untick "Account is disabled".

Step 2 (most tutorials skip this part):

run gpedit.msc . Browse the Computer config / Windows Settings / Security Settings / Local Policies

There remove Guest from "Deny log on locally", and add it to "Allow log on locally"

Restart the computer and the Guest account will be visible on the logon screen, and will works for you like in prev Windows-es without creating a fake local account (with more power than a guest)