cancel
Showing results for 
Search instead for 
Did you mean: 

Event Log Audit Failure 4625

infrasolutions
Level 3

Hi everybody,

I am using Backup Exec 16 and everyday it's generating hundreds of logs in the event viewer stating logon failure with the event ID 4625. The logs are coming from the Backup Exec Server using Administrator account. It is using the credentials on the Backup Exec server to try to connect to the hosts machines. Since the Administrator accounts on the hosts all have different credentials it is logging alot of errors.

Each hosts have their own credentials in the accounts manager of Backup Exec and the backups are workings. But for some reason Backup Exec aswell as connecting with the right credentials is also using the credentials of it's own local server.

I tried setting up the System Logon Account for a common administrator account in the domain. (NOT WORKING)

I tried changing the following services to log on with the Domain Admin on the Backup Exec server

  • Backup Exec Agent Browser
  • Backup Exec Device & Media Service
  • Backup Exec Job Engine
  • Backup Exec Management Service
  • Backup Exec Server

The Backup Exec server was now using the Domain Admin to connect to the servers so it was not generating any 4625 anymore but the Backups were not working anymore.

Since we have a central log server it is really anoying and we DO NEED to log those 4625. If any of you have any idea please feel free to tell me.

I appreciate it

1 REPLY 1

Gurvinder
Moderator
Moderator
Employee Accredited Certified

I am not sure if this would help but check if the events are coming around the time the credential check is scheduled. You can check it by going in the backup exec settings -> logonaccounts -> check that the backup sources in the job can be accessed with the logon accounts you selected. 

If this is not the case, I would request you to open a support case