From ee9ea1c8450dfc67f4dcf7c9f059e8224e74681b Mon Sep 17 00:00:00 2001
From: Herbert Mauerer <41573578+HerbertMauerer@users.noreply.github.com>
Date: Thu, 20 Jan 2022 09:47:36 +0100
Subject: [PATCH 1/3] add detail this also logs event 4625
We may have customers seeing event 4625 as additional hint the task failed.
---
.../credential-guard/credential-guard-known-issues.md | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/windows/security/identity-protection/credential-guard/credential-guard-known-issues.md b/windows/security/identity-protection/credential-guard/credential-guard-known-issues.md
index 1dae9e49d5..a27265135f 100644
--- a/windows/security/identity-protection/credential-guard/credential-guard-known-issues.md
+++ b/windows/security/identity-protection/credential-guard/credential-guard-known-issues.md
@@ -33,7 +33,7 @@ The following known issue has been fixed in the [Cumulative Security Update for
Failure occurred in ‘LogonUserExEx’.
User Action: Ensure the credentials for the task are correctly specified.
Additional Data: Error Value: 2147943726. 2147943726: ERROR\_LOGON\_FAILURE (The user name or password is incorrect)."
-- When enabling NTLM audit on the domain controller, an Event ID 8004 with an indecipherable username format is logged. For example:
+- When enabling NTLM audit on the domain controller, an Event ID 8004 with an indecipherable username format is logged. You get a similar user name in a user logon failure event 4525 wiith error 0xC0000064 on the machine itself. For example:
> Log Name: Microsoft-Windows-NTLM/Operational
Source: Microsoft-Windows-Security-Netlogon
Event ID: 8004
From d7c71a63c328ac296f0d1847b93ed0518da74c67 Mon Sep 17 00:00:00 2001
From: Denise Vangel-MSFT
Date: Mon, 24 Jan 2022 09:29:24 -0800
Subject: [PATCH 2/3] Update credential-guard-known-issues.md
---
.../credential-guard/credential-guard-known-issues.md | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/windows/security/identity-protection/credential-guard/credential-guard-known-issues.md b/windows/security/identity-protection/credential-guard/credential-guard-known-issues.md
index a27265135f..ef9971f738 100644
--- a/windows/security/identity-protection/credential-guard/credential-guard-known-issues.md
+++ b/windows/security/identity-protection/credential-guard/credential-guard-known-issues.md
@@ -12,7 +12,7 @@ ms.author: dansimp
manager: dansimp
ms.collection: M365-identity-device-management
ms.topic: article
-ms.date: 08/17/2017
+ms.date: 01/24/2022
ms.reviewer:
---
From 9202efabd5af60f8081d15869d745f0f383ef101 Mon Sep 17 00:00:00 2001
From: Denise Vangel-MSFT
Date: Mon, 24 Jan 2022 09:29:45 -0800
Subject: [PATCH 3/3] Update
windows/security/identity-protection/credential-guard/credential-guard-known-issues.md
Co-authored-by: JohanFreelancer9 <48568725+JohanFreelancer9@users.noreply.github.com>
---
.../credential-guard/credential-guard-known-issues.md | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/windows/security/identity-protection/credential-guard/credential-guard-known-issues.md b/windows/security/identity-protection/credential-guard/credential-guard-known-issues.md
index ef9971f738..0f5e251a7f 100644
--- a/windows/security/identity-protection/credential-guard/credential-guard-known-issues.md
+++ b/windows/security/identity-protection/credential-guard/credential-guard-known-issues.md
@@ -33,7 +33,7 @@ The following known issue has been fixed in the [Cumulative Security Update for
Failure occurred in ‘LogonUserExEx’.
User Action: Ensure the credentials for the task are correctly specified.
Additional Data: Error Value: 2147943726. 2147943726: ERROR\_LOGON\_FAILURE (The user name or password is incorrect)."
-- When enabling NTLM audit on the domain controller, an Event ID 8004 with an indecipherable username format is logged. You get a similar user name in a user logon failure event 4525 wiith error 0xC0000064 on the machine itself. For example:
+- When enabling NTLM audit on the domain controller, an Event ID 8004 with an indecipherable username format is logged. You also get a similar user name in a user logon failure event 4525 with error 0xC0000064 on the machine itself. For example:
> Log Name: Microsoft-Windows-NTLM/Operational
Source: Microsoft-Windows-Security-Netlogon
Event ID: 8004