Event ID 4625 logged on install and subsequent reboots

Cythrawl
Cythrawl
edited July 23 in Install and Updates

Duplicated this several times now.

When I install Bitdefender Total Security it logs two events in Audit Faliure of 4625

It complains that the built in Administrator account is disabled and the DefaultAccount.

See below This is for the DefaultAccount the Error is the same for the Administrator account (Blocked PC Name for obvious reasons)

An account failed to log on.

Subject:

Security ID:SYSTEM

Account Name:************$

Account Domain:WORKGROUP

Logon ID:0x3E7

Logon Type:2

Account For Which Logon Failed:

Security ID:NULL SID

Account Name:DefaultAccount

Account Domain: ************

Failure Information:

Failure Reason:Account currently disabled.

Status:0xC000006E

Sub Status:0xC0000072

Process Information:

Caller Process ID:0x5ac

Caller Process Name:C:\Windows\System32\lsass.exe

Network Information:

Workstation Name: **********

Source Network Address:-

Source Port:-


Detailed Authentication Information:

Logon Process:Advapi  

Authentication Package:Negotiate

Transited Services:-

Package Name (NTLM only):-

Key Length:0

These accounts should and ARE disabled on all installs of windows. If I uninstall Bitdefender and go back to Windows Defender the Events are no longer logged.

It looks like while BitDefender is installed it is trying to log on with both of these accounts..

If I enable them both and reboot the EventID's go away, but that isn't best practice.

Is there any way to fix this issue.

Thanks

Answers

This discussion has been closed.

All Time Leaders

Categories

Defenders of the month