Failed Windows Logon (4625) to ePO Server During ASC

[jchapuran]

Recently I noticed on about half of our Windows servers that every time we perform an ASC through McAfee Agent, those servers are trying to perform a series of network logons to the ePO server and failing (security log event code 4625). The source is the computer account itself (ex: domain\SERVERNAME$). The failure is good because I don't think there should be any logon attempts at all. I don't see any logon attempts by the other half of our Windows servers. Furthermore, there are no errors in the ePO server log, the client agent log, or anywhere else. Everything appears to be working perfectly fine. Has anyone seen this before or have any idea what could cause this behavior?

[cdinet]

Are they possibly running dlp where they are trying to upload evidence files?

[jchapuran]

Could be? Every server has DLP installed as well. I don't know much about that product. They're all using the same default policies for it. I can look more into this though, maybe I'll see some clues in the logs.

[cdinet · Accepted solution]

Check out this kb.

https://kc.mcafee.com/corporate/index?page=content&id=KB93248

[jchapuran]

Thank you for this. I was setting it to use local Windows system credentials instead of a domain account. I still don't understand why there was no login attempt for the other servers, maybe DLP is busted on them. But I've resolved the issue now. Thank you!!

[cdinet]

Glad to hear it and glad to assist.