Monitoring and reporting for Veeam Backup & Replication, VMware vSphere and Microsoft Hyper-V
Post Reply
inkostin
Influencer
Posts: 18
Liked: never
Joined: Dec 14, 2018 11:34 am
Full Name: Ilya Kostin
Contact:

Bad Hyper-V username logon attempt

Post by inkostin » Dec 16, 2018 1:08 pm

Summary: This event records a failed user logon attempt. The combination of username, password and permissions is the mechanism by which Hyper-V server authenticate a user for access and authorize the user to perform activities
Cause: Failed logons are due to no match existing between the provided username and password
Resolution: Check for some automated process that might be logging in with the incorrect or expired password


How to solve a problem? Event 4625?

Server 2016, VBR - 9.5.0.1922.Update3a.

nielsengelen
Veeam Software
Posts: 2619
Liked: 539 times
Joined: Jul 15, 2013 11:09 am
Full Name: Niels Engelen
Contact:

Re: Bad Hyper-V username logon attempt

Post by nielsengelen » Dec 16, 2018 1:41 pm

Ilya, this means you have someone trying to logon with the wrong credentials. If this is not you (or u didn't change any password recently causing it), I suggest you start checking hyper-v system logs as this may be a potential security breach in your infrastructure.
VCP-DCV
Veeam Certified Architect (VMCA)
http://foonet.be

Shestakov
Veeam Software
Posts: 6910
Liked: 700 times
Joined: May 21, 2014 11:03 am
Full Name: Nikita Shestakov
Location: Prague
Contact:

Re: Bad Hyper-V username logon attempt

Post by Shestakov » Dec 16, 2018 9:37 pm

Hi Ilya,
Please provide a support case number as required by forum's rules when asking a question about technical error.

inkostin
Influencer
Posts: 18
Liked: never
Joined: Dec 14, 2018 11:34 am
Full Name: Ilya Kostin
Contact:

Re: Bad Hyper-V username logon attempt

Post by inkostin » Dec 17, 2018 5:42 am

Techical support closed.Edition=Standard. Support expiration date=08/11/2018

Purchase of the Enterprise license is expected in January 2019.

inkostin
Influencer
Posts: 18
Liked: never
Joined: Dec 14, 2018 11:34 am
Full Name: Ilya Kostin
Contact:

Re: Bad Hyper-V username logon attempt

Post by inkostin » Dec 17, 2018 5:49 am

Input type: 3
ID Security: NULL SID
Account name: admin
Domain of the account: Domain.Local

Data on network:
Workstation name: -
Network address of a source: -
Port of a source: -

Data on authentication:
Process of an input: Kerberos
Authentication packet: Kerberos
Intermediate services: -
Packet name (only NTLM): -
Key length: 0

This is the system user: admin

nielsengelen
Veeam Software
Posts: 2619
Liked: 539 times
Joined: Jul 15, 2013 11:09 am
Full Name: Niels Engelen
Contact:

Re: Bad Hyper-V username logon attempt

Post by nielsengelen » Dec 17, 2018 7:14 am

As mentioned please contact support for help as we can’t tell what happened besides a guess via the forums.

Most likely someone tried to logon with wrong username and if this isn’t someone from your company check system and network logs to find more info.
VCP-DCV
Veeam Certified Architect (VMCA)
http://foonet.be

inkostin
Influencer
Posts: 18
Liked: never
Joined: Dec 14, 2018 11:34 am
Full Name: Ilya Kostin
Contact:

Re: Bad Hyper-V username logon attempt

Post by inkostin » Dec 17, 2018 9:07 am

Closed.

Shestakov
Veeam Software
Posts: 6910
Liked: 700 times
Joined: May 21, 2014 11:03 am
Full Name: Nikita Shestakov
Location: Prague
Contact:

Re: Bad Hyper-V username logon attempt

Post by Shestakov » Dec 17, 2018 3:26 pm

Do you mean the support team has already assisted you on this case?
What we mean is support case number. You achieve one when you reach the technical support. Usually it starts with 03...

Post Reply

Who is online

Users browsing this forum: No registered users and 2 guests