cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

Failed Windows Logon (4625) to ePO Server During ASC

Jump to solution

Recently I noticed on about half of our Windows servers that every time we perform an ASC through McAfee Agent, those servers are trying to perform a series of network logons to the ePO server and failing (security log event code 4625). The source is the computer account itself (ex: domain\SERVERNAME$). The failure is good because I don't think there should be any logon attempts at all. I don't see any logon attempts by the other half of our Windows servers. Furthermore, there are no errors in the ePO server log, the client agent log, or anywhere else. Everything appears to be working perfectly fine. Has anyone seen this before or have any idea what could cause this behavior?

1 Solution

Accepted Solutions
cdinet
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 4 of 6

Re: Failed Windows Logon (4625) to ePO Server During ASC

Jump to solution

Check out this kb.

https://kc.mcafee.com/corporate/index?page=content&id=KB93248

 

Was my reply helpful?
If this information was helpful in any way or answered your question, will you please select Accept as Solution in my reply and together we can help other members?

View solution in original post

5 Replies
cdinet
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 2 of 6

Re: Failed Windows Logon (4625) to ePO Server During ASC

Jump to solution

Are they possibly running dlp where they are trying to upload evidence files?

 

Was my reply helpful?
If this information was helpful in any way or answered your question, will you please select Accept as Solution in my reply and together we can help other members?

Re: Failed Windows Logon (4625) to ePO Server During ASC

Jump to solution

Could be? Every server has DLP installed as well. I don't know much about that product. They're all using the same default policies for it. I can look more into this though, maybe I'll see some clues in the logs.

cdinet
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 4 of 6

Re: Failed Windows Logon (4625) to ePO Server During ASC

Jump to solution

Check out this kb.

https://kc.mcafee.com/corporate/index?page=content&id=KB93248

 

Was my reply helpful?
If this information was helpful in any way or answered your question, will you please select Accept as Solution in my reply and together we can help other members?

Re: Failed Windows Logon (4625) to ePO Server During ASC

Jump to solution

Thank you for this. I was setting it to use local Windows system credentials instead of a domain account. I still don't understand why there was no login attempt for the other servers, maybe DLP is busted on them. But I've resolved the issue now. Thank you!!

cdinet
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 6 of 6

Re: Failed Windows Logon (4625) to ePO Server During ASC

Jump to solution

Glad to hear it and glad to assist.

Was my reply helpful?
If this information was helpful in any way or answered your question, will you please select Accept as Solution in my reply and together we can help other members?

You Deserve an Award
Don't forget, when your helpful posts earn a kudos or get accepted as a solution you can unlock perks and badges. Those aren't the only badges, either. How many can you collect? Click here to learn more.

Community Help Hub

    New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

  • Find Forum FAQs
  • Learn How to Earn Badges
  • Ask for Help
Go to Community Help

Join the Community

    Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

  • Get helpful solutions from McAfee experts.
  • Stay connected to product conversations that matter to you.
  • Participate in product groups led by McAfee employees.
Join the Community
Join the Community