Computer going through task sequence creating many audit failure events for local Administrator account. RRS feed

  • Question

  • We support multiple customers with MDT 2013 Update 2. One site is causing a lot of security failure audit events 4625 and 4776 on domain controllers during task sequence.

    The 4625 events seem to work sequentially through source port. The last time this issue occurred, it went from port 54860 to 86239. All of the events are for logon of local Administrator on PC running task sequence. I have not determined yet what stage of task sequence PC is at when this happens.

    Anyone have thoughts on why this local logon is hitting DC and what to do to resolve?

    Wednesday, September 20, 2017 3:38 PM