vmtoolsd.exe triggering Windows Security Log Event ID 4625
Article ID: 451040
Updated On:
Products
Issue/Introduction
Event ID 4625 logs can be found in the Windows Event Viewer -> Windows Logs -> Security
Environment
- ESXi
- vCenter Server
- Windows based virtual machines
Cause
This is most commonly caused by automated guest OS operations.
The vmtoolsd.exe process manages communication between the ESXi host/vCenter and the virtual machine's operating system. If a backup solution (like Veeam, Commvault, or Altaro), a monitoring script, or an administrative command uses VMware Guest Operations API to execute tasks inside the VM, it must supply OS credentials.
Resolution
Check any scripts or solutions in the environment and verify they are not configured to use the user account reported in the 4625 Event.
Additional Information
This event is generated when a logon request fails. It is generated on the computer where access was attempted.
The Subject fields indicate the account on the local system which requested the logon.
Feedback
