Event ID 4625 logged on install and subsequent reboots

Cythrawl
Cythrawl
in Install & Updates

Duplicated this several times now.

When I install Bitdefender Total Security it logs two events in Audit Faliure of 4625

It complains that the built in Administrator account is disabled and the DefaultAccount.

See below This is for the DefaultAccount the Error is the same for the Administrator account (Blocked PC Name for obvious reasons)

An account failed to log on.


Subject:

Security ID: SYSTEM

Account Name: XXXXXXXXXXX$

Account Domain: WORKGROUP

Logon ID: 0x3E7


Logon Type: 2


Account For Which Logon Failed:

Security ID: NULL SID

Account Name: DefaultAccount

Account Domain: XXXXXXXXXXXX


Failure Information:

Failure Reason: Account currently disabled.

Status: 0xC000006E

Sub Status: 0xC0000072


Process Information:

Caller Process ID: 0x5ac

Caller Process Name: C:\Windows\System32\lsass.exe


Network Information:

Workstation Name: XXXXXXXXXX

Source Network Address: -

Source Port: -


Detailed Authentication Information:

Logon Process: Advapi  

Authentication Package: Negotiate

Transited Services: -

Package Name (NTLM only): -

Key Length: 0



These accounts should and ARE disabled on all installs of windows. If I uninstall Bitdefender and go back to Windows Defender the Events are no longer logged.

It looks like while BitDefender is installed it is trying to log on with both of these accounts..

If I enable them both and reboot the EventID's go away, but that isn't best practice.

Is there any way to fix this issue.

Thanks

Answers

All Time Leaders

Categories

Defenders of the month