AnsweredAssumed Answered

Windows Event ID 4625, AFService Account Failed to Log On

Question asked by on Jun 17, 2019
Latest reply on Jun 19, 2019 by sraposo


   This morning I was notified by one of our Splunk guys that my W2K12R2 Asset Framework 2018 server is generating a bunch of these events. The events are logged as far back as 6/1, thought it probably started earlier, and is generating  about 8 entries per minute! This server also hosts PIVision 2017 R2 SP1. 


   Looking at the details I see the Failure Reason is "Unknown user name or bad password", Status 0xC000006D, sub status 0xc000064. The ProcessName is F:\Program Files\PIPC\AF\AFService.exe. The account is NT Service\AFService, which as I recall is a local virtual service. 


   The first thing I did was reboot the server. No Joy. Next I examined the Services Control Panel and determined none of the services was using this account and it does not exist locally. 


   My next thought was that the NT Service\AF Service account on the data collector was attempting to contact the AF Server. The data collector is running W2K8 and the GSE D3 DBA PI Interface. I stopped al the PI Services on the data collector but the errors persist. Furthermore, the NT Service\AFService virtual account does not exist on this box either.


   At this point I am at a loss for where to begin looking. Any ideas?