New
#1
Calling UAC prompt causes an event 4625 every time
That's what I discovered, after launching event viewer as an admin. They are categorized as "Microsoft Windows security auditing". I have found other matching reports online and pasted one here:
Code:An account failed to log on. Subject: Security ID: SYSTEM Account Name: DESKTOP-xxx Account Domain: WORKGROUP Logon ID: 0x3E7 Logon Type: 11 Account For Which Logon Failed: Security ID: NULL SID Account Name: "My local administrator account" Account Domain: DESKTOP-xxx Failure Information: Failure Reason: An Error occurred during Logon. Status: 0xC000010B Sub Status: 0x0 Process Information: Caller Process ID: 0x8ac Caller Process Name: C:\Windows\System32\consent.exe Network Information: Workstation Name: DESKTOP-xxx Source Network Address: ::1 Source Port: 0 Detailed Authentication Information: Logon Process: CredPro Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0
Logon type 11 supposedly is "CachedInteractive", and the description is "The domain controller was not contacted to verify the credentials", but so far I haven't been able to find a description for the status 0xC000010B.
Last edited by i486; 22 Feb 2021 at 20:34.