-----Original Message-----
From: Alexander Bokovoy [mailto:abokovoy@redhat.com]
Sent: Wednesday, July 12, 2017 1:45 AM
To: FreeIPA users list <freeipa-users(a)lists.fedorahosted.org>
Cc: Andy Thompson <Andy.Thompson(a)e-tcc.com>
Subject: Re: [Freeipa-users] IPA to AD trust 4625 NULL SID logon failures
On ti, 11 heinä 2017, Andy Thompson via FreeIPA-users wrote:
>We are troubleshooting an account lockout issue and came across the
>error below in the windows DC event logs while investigating. They are
>appearing in two of our environments, the third is quiet. These are
>logged several times a minute and are likely unrelated to the lockout
>issue, but what IPA process could cause this?
I think these are anonymous connections and unrelated to your lockouts.
They definitely aren't related to the lockouts but what anonymous connection would
come from IPA? I find it odd I'm only seeing it in two of my environments this much
but they all have AD trusts in place
> >
> >Running IPA (ipa-server-4.4.0-14.el7_3.7) on RHEL 7.1
> >
> >An account failed to log on.
> >
> >Subject:
> > Security ID: NULL SID
> > Account Name: -
> > Account Domain: -
> > Logon ID: 0x0
> >
> >Logon Type: 3
> >
> >Account For Which Logon Failed:
> > Security ID: NULL SID
> > Account Name:
> > Account Domain:
> >
> >Failure Information:
> > Failure Reason: An Error occured during Logon.
> > Status: 0x80090302
> > Sub Status: 0x0
> >
> >Process Information:
> > Caller Process ID: 0x0
> > Caller Process Name: -
> >
> >Network Information:
> > Workstation Name: -
> > Source Network Address: <IPA server address>
> > Source Port: 35392
> >
> >Detailed Authentication Information:
> > Logon Process:
> > Authentication Package: NTLM
> > Transited Services: -
> > Package Name (NTLM only): -
> > Key Length: 0
> >_______________________________________________
> >FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
> >To unsubscribe send an email to
> >freeipa-users-leave(a)lists.fedorahosted.org
>
> --
> / Alexander Bokovoy