Share via

Event ID 4625, Username same as source of the event

Anonymous
2025-01-15T03:05:17+00:00

Hi,

Right now, im facing issue like this, there are failed login events (EventID:4625) but the TargetUserName same like the source name,

Is it normal? is it activity that run by system? I hope someone can help me fix this issue, because i got lot of server, and some of them is like these.

Source IpAddress TargetUserName TargetDomainName Count
aamrds.aa.lcl ::1 AAMRDS AA 2,246
bbmulp.bb.lcl fe80::a1da:d25a:987c:ld22 BBMULP BB 1,783
aafiv.aa.lcl ::1 AAFIV AA 1,535
bbso01.bb.lcl ::1 BBSO01 BB 1,517
bbso02.bb.lcl 172.24.1.1 BBSO02 BB 1,205
bbso03.bb.lcl ::1 BBSO03 BB 1,167
aatsk.aa.lcl fe80::d234:4f56:fc20:2104 AATSK AA 1,162
nsg01.bb.lcl ::1 NSG01 BB 1,085
Windows Server Identity and access User logon and profiles

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question. To protect privacy, user profiles for migrated questions are anonymized.

0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Anonymous
    2025-01-15T08:42:05+00:00

    Hi

    Thank you for posting in Microsoft Community.

    It is not uncommon for you to encounter Event ID 4625 (Login Failure Event) where the TargetUserName is the same as the Source's username. Usually, this is not a normal activity of the system, but it can indeed be caused by some specific system behavior or configuration issues. We can analyze and resolve this issue by doing the following.

    1. Explain the contents of Event ID 4625

    Event 4625 is the “Logon Failure” event in the Windows Security Log. The following information is usually recorded: 

    TargetUserName: the username of the target user, i.e. the account that attempted to log on. 

Source: The computer or IP address that initiated the login request. 

Failure Reason: The reason for the failure, such as an incorrect password or a locked user account.

    If TargetUserName is the same as Source, this is usually indicated: 

    The account that failed to log in was the account itself that was performing the login operation. 

This can be due to a failure of a system process, service, task scheduler, or application program while trying to log in using that account.
    1. Common causes and explanations
    2. System and service attempts to log on

    Some Windows services or processes may try to perform other logins as the currently logged on user. This usually happens in the following situations: 

    A Task Scheduler or other timed task tries to run as the current user. 

An authentication failure may occur when a system service or other background process tries to access resources. 

Automatic login attempts: If the computer has some form of automatic login enabled (e.g., through scripting or configuration), this may result in a mismatch failure.
    1. Login Authentication and Privilege Issues Repeated Login Attempts: For example, the system repeatedly tries to log in with the target username due to some configuration error or permission issue. Expired or incorrect password: Login fails when the user account password expires or the user enters an incorrect password. Account lockout: Multiple failed logon attempts result in the account being locked out, and the system then tries to log on again, but fails each time.
    2. Local Computer or Domain Policy Logon Scripts: If you have a logon script in your environment and the script is run without properly handling permissions or authentication, it may cause multiple failed logon attempts. Security Policies: For example, Group Policies or Local Security Policies (e.g., Login Restrictions, Password Policies, etc.) may restrict certain types of logins.

    I hope you find the above information helpful.

    Yours sincerely

    Runjie Zhai

    0 comments