Bad Hyper-V username logon attempt

[inkostin]

Summary: This event records a failed user logon attempt. The combination of username, password and permissions is the mechanism by which Hyper-V server authenticate a user for access and authorize the user to perform activities
Cause: Failed logons are due to no match existing between the provided username and password
Resolution: Check for some automated process that might be logging in with the incorrect or expired password


How to solve a problem? Event 4625?

Server 2016, VBR - 9.5.0.1922.Update3a.

[nielsengelen]

Ilya, this means you have someone trying to logon with the wrong credentials. If this is not you (or u didn't change any password recently causing it), I suggest you start checking hyper-v system logs as this may be a potential security breach in your infrastructure.

[Shestakov]

Hi Ilya,
Please provide a support case number as required by forum's rules when asking a question about technical error.

[inkostin]

Techical support closed.Edition=Standard. Support expiration date=08/11/2018

Purchase of the Enterprise license is expected in January 2019.

[inkostin]

Input type: 3
ID Security: NULL SID
Account name: admin
Domain of the account: Domain.Local

Data on network:
Workstation name: -
Network address of a source: -
Port of a source: -

Data on authentication:
Process of an input: Kerberos
Authentication packet: Kerberos
Intermediate services: -
Packet name (only NTLM): -
Key length: 0

This is the system user: admin

[nielsengelen]

As mentioned please contact support for help as we can’t tell what happened besides a guess via the forums.

Most likely someone tried to logon with wrong username and if this isn’t someone from your company check system and network logs to find more info.

[inkostin]

Closed.

[Shestakov]

Do you mean the support team has already assisted you on this case?
What we mean is support case number. You achieve one when you reach the technical support. Usually it starts with 03...