Windows Server 2008 Shared Folder Access

0

I have a Windows Server 2008 with a folder shared. When i try to access the shared folder from within the network i get this Audit Failure:

An account failed to log on.

Subject:
    Security ID:        NULL SID
    Account Name:       -
    Account Domain:     -
    Logon ID:       0x0

Logon Type:         3

Account For Which Logon Failed:
    Security ID:        NULL SID
    Account Name:       laurentiu
    Account Domain:     WIN-CS9MB57MU5H

Failure Information:
    Failure Reason:     An Error occured during Logon.
    Status:         0xc000006d
    Sub Status:     0x0

Process Information:
    Caller Process ID:  0x0
    Caller Process Name:    -

Network Information:
    Workstation Name:   WIN-CS9MB57MU5H
    Source Network Address: 13.211.*.*
    Source Port:        49198

Detailed Authentication Information:
    Logon Process:      
    Authentication Package: NTLM
    Transited Services: -
    Package Name (NTLM only):   -
    Key Length:     0

- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
  <Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-A5BA-3E3B0328C30D}" /> 
  <EventID>4625</EventID> 
  <Version>0</Version> 
  <Level>0</Level> 
  <Task>12544</Task> 
  <Opcode>0</Opcode> 
  <Keywords>0x8010000000000000</Keywords> 
  <TimeCreated SystemTime="2018-11-02T10:16:34.478335100Z" /> 
  <EventRecordID>63334</EventRecordID> 
  <Correlation /> 
  <Execution ProcessID="680" ThreadID="728" /> 
  <Channel>Security</Channel> 
  <Computer>WIN-CS9MB57MU5H</Computer> 
  <Security /> 
  </System>
- <EventData>
  <Data Name="SubjectUserSid">S-1-0-0</Data> 
  <Data Name="SubjectUserName">-</Data> 
  <Data Name="SubjectDomainName">-</Data> 
  <Data Name="SubjectLogonId">0x0</Data> 
  <Data Name="TargetUserSid">S-1-0-0</Data> 
  <Data Name="TargetUserName">laurentiu</Data> 
  <Data Name="TargetDomainName">WIN-CS9MB57MU5H</Data> 
  <Data Name="Status">0xc000006d</Data> 
  <Data Name="FailureReason">%%2304</Data> 
  <Data Name="SubStatus">0x0</Data> 
  <Data Name="LogonType">3</Data> 
  <Data Name="LogonProcessName" /> 
  <Data Name="AuthenticationPackageName">NTLM</Data> 
  <Data Name="WorkstationName">WIN-CS9MB57MU5H</Data> 
  <Data Name="TransmittedServices">-</Data> 
  <Data Name="LmPackageName">-</Data> 
  <Data Name="KeyLength">0</Data> 
  <Data Name="ProcessId">0x0</Data> 
  <Data Name="ProcessName">-</Data> 
  <Data Name="IpAddress">13.211.*.*</Data> 
  <Data Name="IpPort">49198</Data> 
  </EventData>
  </Event>

Machine is up to date, credentials 100% valid, even with Administrator not working.

Does any one have any idea how i can make this work?

windows-server-2008
network-share

1 Answer

0

Make sure the computer is correctly joined to the domain, and not using local credential.

In the audit:

Account Domain: WIN-CS9MB57MU5H

In the audit for the source:

Workstation Name: WIN-CS9MB57MU5H

As you can see it use a local account. If you are in a workgroup it's a normal behavior, but that would mean that the user laurentiu need to be created on that remote machine with the same credential.

answered on Server Fault Nov 2, 2018 by yagmoth555

User contributions licensed under CC BY-SA 3.0