Calling UAC prompt causes an event 4625 every time  

  1. Posts : 263
    Windows 10 Home 22H2

    Calling UAC prompt causes an event 4625 every time

    That's what I discovered, after launching event viewer as an admin. They are categorized as "Microsoft Windows security auditing". I have found other matching reports online and pasted one here:

    An account failed to log on.
        Security ID:        SYSTEM
        Account Name:       DESKTOP-xxx
        Account Domain:     WORKGROUP
        Logon ID:       0x3E7
    Logon Type:         11
    Account For Which Logon Failed:
        Security ID:        NULL SID
        Account Name:       "My local administrator account"
        Account Domain:     DESKTOP-xxx
    Failure Information:
        Failure Reason:     An Error occurred during Logon.
        Status:         0xC000010B
        Sub Status:     0x0
    Process Information:
        Caller Process ID:  0x8ac
        Caller Process Name:    C:\Windows\System32\consent.exe
    Network Information:
        Workstation Name:   DESKTOP-xxx
        Source Network Address: ::1
        Source Port:        0
    Detailed Authentication Information:
        Logon Process:      CredPro
        Authentication Package: Negotiate
        Transited Services: -
        Package Name (NTLM only):   -
        Key Length:     0

    Logon type 11 supposedly is "CachedInteractive", and the description is "The domain controller was not contacted to verify the credentials", but so far I haven't been able to find a description for the status 0xC000010B.
    Last edited by i486; 22 Feb 2021 at 20:34.
      My Computer

  2. Posts : 1,604
    Win 10 home 20H2 19042.1110

    This is what I found:
    STATUS_INVALID_LOGON_TYPE 0xC000010B Indicates an invalid value has been provided for the LogonType requested.
      My Computers

  3. Posts : 263
    Windows 10 Home 22H2
    Thread Starter

    I've checked another computer running build 1909 and it gets identical audit failure reports like these also when UAC is triggered. These systems have nothing else of note in common except that the admin accounts are local. Strange thing was however that these started happening there on 27.1.2021, even though the event log history hadn't been erased then. I can't compare that to mine since I've had a feature update installed in early february so the history was wiped away.

    Could this be the fault of some cumulative update that introduces a bug to all builds? I've run sfc scannow after checking component store health on both systems and it repaired some files, subsequent scans haven't revealed any corruption since. I have a suspicion that these are widespread, there are identical reports from Win 7 systems even.
    Last edited by i486; 22 Feb 2021 at 21:03.
      My Computer

  4. Posts : 1,604
    Win 10 home 20H2 19042.1110
      My Computers


  Related Discussions
Our Sites
Site Links
About Us
Windows 10 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 10" and related materials are trademarks of Microsoft Corp.

Designer Media Ltd
All times are GMT -5. The time now is 00:50.
Find Us

Windows 10 Forums