在3个独立的系统中，在域控制器服务器上多次logging以下事件（每天30到4,000次，具体取决于系统）：
An account failed to log on. Subject: Security ID: SYSTEM Account Name: %domainControllerHostname%$ Account Domain: %NetBIOSDomainName% Logon ID: 0x3E7 Logon Type: 3 Account For Which Logon Failed: Security ID: NULL SID Account Name: Account Domain: Failure Information: Failure Reason: Unknown user name or bad password. Status: 0xc000006d Sub Status: 0xc0000064 Process Information: Caller Process ID: 0x1ec Caller Process Name: C:\Windows\System32\lsass.exe Network Information: Workstation Name: %domainControllerHostname% Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Schannel Authentication Package: Kerberos Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon request fails. It is generated on the computer where access was attempted. The Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network). The Process Information fields indicate which account and process on the system requested the logon. The Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. 这个事件与我在研究过程中发现的所有其他事件稍有不同，但是我确定了以下内容：
Event ID: 4625 。 “帐户无法login” 。 Logon Type: 3 。 “networking（即从该networking上的其他地方连接到该计算机上的共享文件夹）” 。 Security ID: NULL SID 。 “有效的帐户没有被识别” 。 Sub Status: 0xC0000064 。 “用户名不存在” 。 Caller Process Name: C:\Windows\System32\lsass.exe 。 本地安全机构子系统服务（LSASS）是Microsoft Windows操作系统中的一个进程，负责在系统上执行安全策略。 它validation用户login到Windows计算机或服务器，处理密码更改，并创build访问令牌。 它也写入Windows安全日志。 Workstation Name: SERVERNAME 。 身份validation请求正由域控制器本身提交。 受影响的系统的相似之处：
受影响的系统的差异：
我在受到最严重影响的系统中注意到了一些有趣的事情：
在terminal/远程桌面服务服务器上logging以下事件，尽pipe无处不在：
An account failed to log on. Subject: Security ID: NULL SID Account Name: - Account Domain: - Logon ID: 0x0 Logon Type: 3 Account For Which Logon Failed: Security ID: NULL SID Account Name: %terminalServerHostname% Account Domain: %NetBIOSDomainName% Failure Information: Failure Reason: Unknown user name or bad password. Status: 0xC000006D Sub Status: 0xC0000064 Process Information: Caller Process ID: 0x0 Caller Process Name: - Network Information: Workstation Name: %terminalServerHostname% Source Network Address: %terminalServerIPv6Address% Source Port: %randomHighNumber% Detailed Authentication Information: Logon Process: NtLmSsp Authentication Package: NTLM Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon request fails. It is generated on the computer where access was attempted. The Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network). The Process Information fields indicate which account and process on the system requested the logon. The Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
所以，总之，这似乎与使用员工用户帐户的台式计算机的networking访问有关，但是我看不出来。
更新2015/08/25 08:48：
在受到最严重影响的系统中，我已经做了以下的事情来隔离这个问题，并且在每次恢复之后：
WseComputerBackupSvc ， WseEmailSvc ， WseHealthSvc ， WseMediaSvc ， WseMgmtSvc和WseNtfSvc ）和通用失败login不会继续。 WseMgmtSvc ），并且通用失败的login未能继续。 我已经仔细检查了Windows Server Essentialspipe理服务（ WseMgmtSvc ）是否对这些通用失败login负责，将其禁用了几天，并且没有通用login失败login并且启用了几天，并且有数以千计的通用失败loginlogin。
更新2015/10/08 09:06：
在2015年10月7日16:42我发现了以下计划的任务：
这个时间框架几乎完全符合上面的行为，所以我禁用它，看看它是否会影响到这个问题。
在2015年10月8日08:57我发现这些通用失败login中只有47个是以不规则的间隔login的。
所以，我进一步缩小了范围。
这个事件通常是由一个陈旧的隐藏证书造成的。 尝试从系统给出这个错误：
从命令提示符处运行： psexec -i -s -d cmd.exe
从新的cmd窗口运行： rundll32 keymgr.dll,KRShowKeyMgr
删除存储的用户名和密码列表中出现的任何项目。 重新启动计算机。
看起来问题是由计划任务“警报评估”造成的。