Forum Discussion

Tej S's avatar
Tej S
Copper Contributor
Sep 19, 2018

PS script causing Failed guest logon

Hello, 

We have a ps1 script to audit AD-Group-Members which runs on a weekly basis.

This queries all the AD users and Groups they are a part of and exports it in a Excel file. This runs on our Domain Controller.

 

On 2nd September, we noticed that during the time, the script was running, there was  956 sign-in attempts on our DC.

The script for Get-ADGroupMembership ran on 4:38PM and completed csv was created at 4:46PM.

Login events started 9/2/2018 4:38:22 PM and continued till 9/2/2018 4:46:29 PM 

 

This is what i see in the Event Viewer (screenshot added)

Account For Which Logon Failed:
Security ID: NULL SID
Account Name: Guest

Failure Information:
Failure Reason: Unknown user name or bad password.
Status: 0xC000006D
Sub Status: 0xC000006A

Detailed Authentication Information:
Logon Process: Advapi
Authentication Package: Negotiate
Transited Services: -
Package Name (NTLM only): -
Key Length: 0

 

Any info on why the script might have caused Logon attempted will be hugely appreciated.

Aslo attached the ps1.

    • Tej S's avatar
      Tej S
      Copper Contributor
      It is a Scheduled task that runs every Sunday.

Resources