6 replies to this topic

[AR556]

Anyone ever see these on their Windows 8 machine in the security section of the log viewer?

Quote

Event ID 4797

"An attempt was made to query the existence of a blank password for an account."

Subject:
Security ID:
Account Name:
Account Domain:
Logon ID:

Additional Information:
Caller Workstation:
Target Account Name: Guest

[DrHaze]

I am getting the same thing
Windows 8 X64 Pro Upgrade from Windows 7 x64
No One seems to be able to answer the question
Avast Antivirus
Comodo 6 Firewall
I get the 4797 for ALL of my accounts, GUEST, Administrator and the other two i have that have admin privileges.
it is at random but regularly/daily goes on

[Praetor]

"Target Account Name: Guest"

an attack?

[+Fus10n]

Praetor, on 29 January 2013 - 02:58, said:

"Target Account Name: Guest"

an attack?

That is what I was thinking

[DrHaze]

It's definately some sort of attack. 21 times all accounts.

Log Name: Security
Source: Microsoft-Windows-Security-Auditing
Date: 1/28/2013 11:34:08 PM
Event ID: 4797
Task Category: User Account Management
Level: Information
Keywords: Audit Success
User: N/A
Computer: phenom
Description:
An attempt was made to query the existence of a blank password for an account.

Subject:
Security ID: phenom\crusader
Account Name: crusader
Account Domain: phenom
Logon ID: 0xA068D

Additional Information:
Caller Workstation: PHENOM
Target Account Name: DrHaze
Target Account Domain: phenom
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-A5BA-3E3B0328C30D}" />
<EventID>4797</EventID>
<Version>0</Version>
<Level>0</Level>
<Task>13824</Task>
<Opcode>0</Opcode>
<Keywords>0x8020000000000000</Keywords>
<TimeCreated SystemTime="2013-01-29T04:34:08.308305800Z" />
<EventRecordID>42164</EventRecordID>
<Correlation />
<Execution ProcessID="1000" ThreadID="3832" />
<Channel>Security</Channel>
<Computer>phenom</Computer>
<Security />
</System>
<EventData>
<Data Name="SubjectUserSid">S-1-5-21-1124263850-194828415-1399416522-1001</Data>
<Data Name="SubjectUserName">crusader</Data>
<Data Name="SubjectDomainName">phenom</Data>
<Data Name="SubjectLogonId">0xa068d</Data>
<Data Name="Workstation">PHENOM</Data>
<Data Name="TargetUserName">DrHaze</Data>
<Data Name="TargetDomainName">phenom</Data>
</EventData>
</Event>

Log Name: Security
Source: Microsoft-Windows-Security-Auditing
Date: 1/28/2013 11:34:08 PM
Event ID: 4797
Task Category: User Account Management
Level: Information
Keywords: Audit Success
User: N/A
Computer: phenom
Description:
An attempt was made to query the existence of a blank password for an account.

Entire log located here... http://pastie.org/5953014

[Grinch]

^ Hey bud, try using pastie.org or something instead of making a giant post.

[DrHaze]

sorry didn't mean to post the whole thing. I can't seem to edit it now either