Authentication Failure on Internet Gateway Microsoft-Windows-Security-Auditing

Products

• Client Management Suite
• IT Management Suite

Issue/Introduction

It has been reported that when reviewing the Windows event viewer System logs, you may see authentication failures. 

Provider
 
[ Name]
Microsoft-Windows-Security-Auditing
 
[ Guid]
{54849625-5478-4994-a5ba-3e3b0328c30d}
 
EventID
4625
 
Version
0
 
Level
0
 
Task
12544
 
Opcode
0
 
Keywords
0x8010000000000000
 
-
TimeCreated
 
[ SystemTime]
2022-10-13T14:53:50.733586500Z
 
EventRecordID
4857642
 
-
Correlation
 
[ ActivityID]
{27b1d4a0-d713-0001-52d5-b12713d7d801}
 
-
Execution
 
[ ProcessID]
768
 
[ ThreadID]
7912
 
Channel
Security
 
Computer

 
Security
 
-
EventData
 
SubjectUserSid
S-1-0-0
 
SubjectUserName
-
 
SubjectDomainName
-
 
SubjectLogonId
0x0
 
TargetUserSid
S-1-0-0
 
TargetUserName
 
TargetDomainName
 
Status
0xc0000192
 
FailureReason
%%2306
 
SubStatus
0x80090325
 
LogonType
3
 
LogonProcessName
Schannel
 
AuthenticationPackageName
Microsoft Unified Security Protocol Provider
 
WorkstationName
-
 
TransmittedServices
-
 
LmPackageName
-
 
KeyLength
0
 
ProcessId
0x0
 
ProcessName
-
 
IpAddress
-
 
IpPort
-

Environment

Release: 8.6

Resolution

Some network entities try to perform logon operations on the gateway, but since we do not allow account authorizations, we fail connections. You can check the gateway log, there must be associated events about blocked handshakes that do not provide client certificates. Verified with Development that these are not of any concern.