Cannot log in cenrtal administrator (Event ID 4625)
Hello everybody,
Somethink has happend on our moss 2007 server. I cannot log central administrator any more or any other web sites under moss. Central administrator keep asking 3 times my user id and password.After that i just see blank screen. Our installation is following:
Moss server:
operating system:Windows server 2008
iis:7.5
Moss 2007
Dataabase server :
Windows server 2008
sql server 2008
reporting service 2008
I found that every time even i try to log in server it generate two messages first one is this:
- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
<Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-A5BA-3E3B0328C30D}" />
<EventID>4625</EventID>
<Version>0</Version>
<Level>0</Level>
<Task>12544</Task>
<Opcode>0</Opcode>
<Keywords>0x8010000000000000</Keywords>
<TimeCreated SystemTime="2010-06-21T11:53:34.378525700Z" />
<EventRecordID>574824</EventRecordID>
<Correlation />
<Execution ProcessID="500" ThreadID="600" />
<Channel>Security</Channel>
<Computer>Mossserver.domain</Computer>
<Security />
</System>
- <EventData>
<Data Name="SubjectUserSid">S-1-0-0</Data>
<Data Name="SubjectUserName">-</Data>
<Data Name="SubjectDomainName">-</Data>
<Data Name="SubjectLogonId">0x0</Data>
<Data Name="TargetUserSid">S-1-0-0</Data>
<Data Name="TargetUserName">dmzspsvc</Data>
<Data Name="TargetDomainName">domain</Data>
<Data Name="Status">0xc000018d</Data>
<Data Name="FailureReason">%%2304</Data>
<Data Name="SubStatus">0x0</Data>
<Data Name="LogonType">3</Data>
<Data Name="LogonProcessName">NtLmSsp</Data>
<Data Name="AuthenticationPackageName">NTLM</Data>
<Data Name="WorkstationName">database server name</Data>
<Data Name="TransmittedServices">-</Data>
<Data Name="LmPackageName">-</Data>
<Data Name="KeyLength">0</Data>
<Data Name="ProcessId">0x0</Data>
<Data Name="ProcessName">-</Data>
<Data Name="IpAddress">Database server ip address</Data>
<Data Name="IpPort">52533</Data>
</EventData>
</Event>
second one is here:
- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
<Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-A5BA-3E3B0328C30D}" />
<EventID>4625</EventID>
<Version>0</Version>
<Level>0</Level>
<Task>12544</Task>
<Opcode>0</Opcode>
<Keywords>0x8010000000000000</Keywords>
<TimeCreated SystemTime="2010-06-21T12:11:31.514120800Z" />
<EventRecordID>574845</EventRecordID>
<Correlation />
<Execution ProcessID="500" ThreadID="2664" />
<Channel>Security</Channel>
<Computer>Mossserve.domain</Computer>
<Security />
</System>
- <EventData>
<Data Name="SubjectUserSid">S-1-0-0</Data>
<Data Name="SubjectUserName">-</Data>
<Data Name="SubjectDomainName">-</Data>
<Data Name="SubjectLogonId">0x0</Data>
<Data Name="TargetUserSid">S-1-0-0</Data>
<Data Name="TargetUserName">dmzspsvc</Data>
<Data Name="TargetDomainName">domain</Data>
<Data Name="Status">0xc000018d</Data>
<Data Name="FailureReason">%%2304</Data>
<Data Name="SubStatus">0x0</Data>
<Data Name="LogonType">3</Data>
<Data Name="LogonProcessName">NtLmSsp</Data>
<Data Name="AuthenticationPackageName">NTLM</Data>
<Data Name="WorkstationName">Database server name</Data>
<Data Name="TransmittedServices">-</Data>
<Data Name="LmPackageName">-</Data>
<Data Name="KeyLength">0</Data>
<Data Name="ProcessId">0x0</Data>
<Data Name="ProcessName">-</Data>
<Data Name="IpAddress">database server ip address</Data>
<Data Name="IpPort">52866</Data>
</EventData>
</Event>
Jouni
June 21st, 2010 3:14pm
Are you making sure you put in your DOMAIN\Username ?
Regards, Aaron www.aaron-rendell.co.uk
Free Windows Admin Tool Kit Click here and download it now
June 21st, 2010 4:53pm