在4625窗口事件(login失败),如下面实际input不正确的凭据?
a)计算机上的用户是否以paulb身份login错误地input了admin-user凭证?
或者b)用户是否以pipe理员用户身份login,inputpaulb的凭据不正确?
WinEvtLog: Security: AUDIT_FAILURE(4625): Microsoft-Windows-Security-Auditing: (no user): no domain: MP-BO-SOA1: An account failed to log on. Subject: Security ID: S-1-4-11-123456789-123456789-123456789-1234 Account Name: admin-user Account Domain: WINSERVER01 Logon ID: 0x6772f Logon Type: 2 Account For Which Logon Failed: Security ID: S-1-0-0 Account Name: paulb Account Domain: Failure Information: Failure Reason: %%2313 Status: 0xc000006d Sub Status: 0xc000006a Process Information: Caller Process ID: 0xfb8 Caller Process Name: C:\Windows\System32\dllhost.exe Network Information: Workstation Name: WINSERVER01 Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon request fails. It is generated on the computer where access was attempted.
帐户admin-user(主题)尝试以交互方式(logintypes2)作为paulblogin,由于密码错误(0xC000006d / 0xC000006A)