我们在 SQL 故障转移群集中运行了两台 Windows 2008 R2 SP1 服务器。在其中一台服务器上，我们在安全日志中收到以下事件每 30 秒。空白部分确实是空白。有人见过类似的问题吗，或者有人帮忙追查这些事件的原因吗？据我所知，没有其他事件日志显示任何相关信息。
Log Name: Security
Source: Microsoft-Windows-Security-Auditing
Date: 10/17/2012 10:02:04 PM
Event ID: 4625
Task Category: Logon
Level: Information
Keywords: Audit Failure
User: N/A
Computer: SERVERNAME.domainname.local
Description:
An account failed to log on.
Subject:
Security ID: SYSTEM
Account Name: SERVERNAME$
Account Domain: DOMAINNAME
Logon ID: 0x3e7
Logon Type: 3
Account For Which Logon Failed:
Security ID: NULL SID
Account Name:
Account Domain:
Failure Information:
Failure Reason: Unknown user name or bad password.
Status: 0xc000006d
Sub Status: 0xc0000064
Process Information:
Caller Process ID: 0x238
Caller Process Name: C:\Windows\System32\lsass.exe
Network Information:
Workstation Name: SERVERNAME
Source Network Address: -
Source Port: -
Detailed Authentication Information:
Logon Process: Schannel
Authentication Package: Kerberos
Transited Services: -
Package Name (NTLM only): -
Key Length: 0
上述所有事件之后发生的第二个事件
Log Name: Security
Source: Microsoft-Windows-Security-Auditing
Date: 10/17/2012 10:02:04 PM
Event ID: 4625
Task Category: Logon
Level: Information
Keywords: Audit Failure
User: N/A
Computer: SERVERNAME.domainname.local
Description:
An account failed to log on.
Subject:
Security ID: NULL SID
Account Name: -
Account Domain: -
Logon ID: 0x0
Logon Type: 3
Account For Which Logon Failed:
Security ID: NULL SID
Account Name:
Account Domain:
Failure Information:
Failure Reason: An Error occured during Logon.
Status: 0xc000006d
Sub Status: 0x80090325
Process Information:
Caller Process ID: 0x0
Caller Process Name: -
Network Information:
Workstation Name: -
Source Network Address: -
Source Port: -
Detailed Authentication Information:
Logon Process: Schannel
Authentication Package: Microsoft Unified Security Protocol Provider
Transited Services: -
Package Name (NTLM only): -
Key Length: 0
编辑更新： 我还有一些信息要补充。我在这台机器上安装了网络监视器，并对 Kerberos 流量进行了过滤，发现以下内容与安全审计日志中的时间戳相对应。
Kerberos AS_Request Cname：CN=SQLInstanceName Realm：domain.local Sname krbtgt/domain.local
DC 的回复：KRB_ERROR：KDC_ERR_C_PRINCIPAL_UNKOWN
然后我检查了响应的DC的安全审计日志，发现以下内容：
A Kerberos authentication ticket (TGT) was requested.
Account Information:
Account Name: X509N:<S>CN=SQLInstanceName
Supplied Realm Name: domain.local
User ID: NULL SID
Service Information:
Service Name: krbtgt/domain.local
Service ID: NULL SID
Network Information:
Client Address: ::ffff:10.240.42.101
Client Port: 58207
Additional Information:
Ticket Options: 0x40810010
Result Code: 0x6
Ticket Encryption Type: 0xffffffff
Pre-Authentication Type: -
Certificate Information:
Certificate Issuer Name:
Certificate Serial Number:
Certificate Thumbprint:
因此，这似乎与 SQL 计算机上安装的证书有关，但仍然不知道该证书为什么会出现问题或存在什么问题。它没有过期等。
答案1
我使用 Microsoft 网络监视器查找导致此问题的流量，并发现此 SQL 服务器与我们的 AD2 服务器之间存在流量。SQL 服务器正在向 SQL 实例名称的计算机帐户发送 Kerberos AS_REQ。AD 服务器将使用 KDC_ERR_C_PRINCIPAL_UNKNOWN 进行响应。我查看了 AD2 服务器上的安全日志，发现了以下失败审核：
A Kerberos authentication ticket (TGT) was requested.
Account Information:
Account Name: X509N:<S>CN=SQLInstanceName
Supplied Realm Name: domain.local
User ID: NULL SID
Service Information:
Service Name: krbtgt/domain.local
Service ID: NULL SID
这似乎是一些证书请求。然后我使用 SysInternals Process Monitor 并发现来自自定义服务的流量具有相同的时间戳。它查询了所有证书存储，但没有找到任何东西。
禁用此服务将停止安全事件。