Logon failure (Event ID 4625) is reported in the Secuity Event log during local or remote backup
Article ID: 100054107
Updated On:
Description
Error Message
Event ID 4625 is triggered in the Security Event log on the remote server for the Logon failure
Example of the Security Event Log message:
Subject:
Security ID: NULL SID
Account Name: -
Account Domain: -
Logon ID: 0x0
Logon Type: 3
Account For Which Logon Failed:
Security ID: NULL SID
Account Name: -
Account Domain: -
Failure Information:
Failure Reason: Unknown user name or bad password.
Status: 0xC000006D
Sub Status: 0xC0000064
Cause
This behavior is seen when the Backup Exec server is in a workgroup, backing up local or remote servers which are in a domain environment. Even if the Backup Exec server is in a domain environment and the backup exec service, backup exec system logon account is a local user, part of the local administrator group, this event would be seen.
Resolution
Workaround to avoid these events :
A) If the Backup Exec server is in a workgroup, then add the Backup Exec Server and the remote server to the domain.
B) If the Backup Exec Server cannot be added to the domain, create a local account on the servers in the domain, with the same name and password as the Backup Exec System Logon Account (SLA).
C) If Backup Exec Server is part of the domain, then make sure the Backup Exec Service account and Backup Exec System Logon account are a domain user with appropriate rights and not a local user part of the administrator group if these events need to be avoided.
D) In a particular case, failure information status reports the 0xC000018B code and caller process name shows sqlservr.exe. This is seen when SQL Server (BKUPEXEC64) is running on a local system account. Changing to a local administrator account for this service fixes this event.
Issue/Introduction
This behavior is seen when the Backup Exec server is in a workgroup and backing up remote servers which are in a domain environment.
This behavior can also be seen if the Backup Exec server is in a domain environment, but the backup exec service and backup exec system logon account is a local user part of the local administrator group.
Additional Information
