Consider the following scenario:
In this scenario, you may notice an increase in the number of failed logon tries in the Security event logs on the domain controllers. A user logging on to Forefront UAG may generate multiple 4625 events every time that they log on. This problem occurs when Forefront UAG tries to look up the groups from multiple sub-domains. The logged events do not affect the user logging on.
- You have multiple domains inside an Active Directory Domain Services (AD DS) forest to which Microsoft Forefront Unified Access Gateway (UAG) 2010 belongs.
- You have users in a child domain of the forest.
- You have Service Pack 3 for Forefront Unified Access Gateway 2010 or Rollup 1 for Forefront Unified Access Gateway 2010 Service Pack 3 installed.
- The Account Domain field in the 4625 event displays the distinguished name (DN) of the parent domain.
- You have users authenticating to Forefront UAG.
In this scenario, you may notice an increase in the number of failed logon tries in the Security event logs on the domain controllers. A user logging on to Forefront UAG may generate multiple 4625 events every time that they log on. This problem occurs when Forefront UAG tries to look up the groups from multiple sub-domains. The logged events do not affect the user logging on.
The 4625 events
The 4625 events may resemble the following:
Log Name: Security
Source: Microsoft-Windows-Security-Auditing
Date: datetime
Event ID: 4625
Task Category: Logon
Level: Information
Keywords: Audit Failure
User: N/A
Computer: dc1.contoso.com
Description:
An account failed to log on.
Subject:
Security ID: SYSTEM
Account Name: UAG01$
Account Domain: CONTOSO
Logon ID: 0x3e7
Logon Type: 3
Account For Which Logon Failed:
Security ID: S-1-0-0
Account Name: username
Account Domain: DC=contoso,DC=com
Failure Information:
Failure Reason: Unknown user name or bad password.
Status: 0xc000006d
Sub Status: 0xc0000064
Process Information:
Caller Process ID:
Caller Process Name: -
Network Information:
Workstation Name: UAG01
Source Network Address: 192.168.0.1
Source Port: 12345
Source: Microsoft-Windows-Security-Auditing
Date: datetime
Event ID: 4625
Task Category: Logon
Level: Information
Keywords: Audit Failure
User: N/A
Computer: dc1.contoso.com
Description:
An account failed to log on.
Subject:
Security ID: SYSTEM
Account Name: UAG01$
Account Domain: CONTOSO
Logon ID: 0x3e7
Logon Type: 3
Account For Which Logon Failed:
Security ID: S-1-0-0
Account Name: username
Account Domain: DC=contoso,DC=com
Failure Information:
Failure Reason: Unknown user name or bad password.
Status: 0xc000006d
Sub Status: 0xc0000064
Process Information:
Caller Process ID:
Caller Process Name: -
Network Information:
Workstation Name: UAG01
Source Network Address: 192.168.0.1
Source Port: 12345