我不是 Windows 专家，所以我希望我只是在这里遗漏了一些简单的东西...好的，这是我的情况：
我试图使用名为“ApacheSu”的新本地帐户在我们的 Windows 2008 服务器上运行 Apache，该帐户是用户的成员。
根据 Apache 文档对将 Web 服务器作为服务运行的要求，该帐户通过组策略被授予“作为服务登录”和“作为操作系统的一部分”的权限。
当我切换 Apache 服务以以本地帐户登录时，该服务无法启动，因为“该帐户无权在此计算机上登录”。
故障信息部分给出的状态为 0xc000006e（状态帐户限制），子状态为 0xc0000070（工作站限制）。
0xc000006e的翻译如下：
1. The username and password are correct, but there is an account restriction on the user account (such as valid workstation, valid logon hours, etc.). The value under SubStatus should provide the restriction details.
2. Active Directory Replication may not be complete
这是 0xc0000070 的翻译：
1. The user is trying to logon from a machine they aren’t assigned to.
2. Active Directory replication may not be complete
第二项是两种状态代码所共有的，但据我所知，Active Directory 组不包含本地帐户，因此我认为这不是问题所在。（但我既不是网络工程师也不是系统管理员。）状态表明子状态应该提供详细信息。子状态表示用户正在尝试从未分配给他们的计算机登录。这对我来说似乎没有意义，因为该帐户是计算机的本地帐户......我不确定我在设置 Apache 作为服务运行时是否遗漏了某些内容，或者是否存在策略或权限问题。有什么想法吗？感谢您提供的任何帮助......以下是事件日志的全文：
Log Name: Security
Source: Microsoft-Windows-Security-Auditing
Date: 10/15/2015 5:05:58 PM
Event ID: 4625
Task Category: Logon
Level: Information
Keywords: Audit Failure
User: N/A
Computer: Y99WS.xxxx.something.com
Description:
An account failed to log on.
Subject:
Security ID: SYSTEM
Account Name: Y99WS$
Account Domain: xxxx
Logon ID: 0x3e7
Logon Type: 5
Account For Which Logon Failed:
Security ID: NULL SID
Account Name: ApacheSu
Account Domain: Y99WS
Failure Information:
Failure Reason: User not allowed to logon at this computer.
Status: 0xc000006e
Sub Status: 0xc0000070
Process Information:
Caller Process ID: 0x230
Caller Process Name: C:\Windows\System32\services.exe
Network Information:
Workstation Name: Y99WS
Source Network Address: -
Source Port: -
Detailed Authentication Information:
Logon Process: Advapi
Authentication Package: Negotiate
Transited Services: -
Package Name (NTLM only): -
Key Length: 0
This event is generated when a logon request fails. It is generated on the computer where access was attempted.
The Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.
The Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).
The Process Information fields indicate which account and process on the system requested the logon.
The Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.
The authentication information fields provide detailed information about this specific logon request.
- Transited services indicate which intermediate services have participated in this logon request.
- Package name indicates which sub-protocol was used among the NTLM protocols.
- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-A5BA-3E3B0328C30D}" />
<EventID>4625</EventID>
<Version>0</Version>
<Level>0</Level>
<Task>12544</Task>
<Opcode>0</Opcode>
<Keywords>0x8010000000000000</Keywords>
<TimeCreated SystemTime="2015-10-15T21:05:58.353398000Z" />
<EventRecordID>2212241</EventRecordID>
<Correlation />
<Execution ProcessID="568" ThreadID="1436" />
<Channel>Security</Channel>
<Computer>Y99WS.xxxx.something.com</Computer>
<Security />
</System>
<EventData>
<Data Name="SubjectUserSid">S-1-5-18</Data>
<Data Name="SubjectUserName">Y99WS$</Data>
<Data Name="SubjectDomainName">xxxx</Data>
<Data Name="SubjectLogonId">0x3e7</Data>
<Data Name="TargetUserSid">S-1-0-0</Data>
<Data Name="TargetUserName">ApacheSu</Data>
<Data Name="TargetDomainName">Y99WS</Data>
<Data Name="Status">0xc000006e</Data>
<Data Name="FailureReason">%%2312</Data>
<Data Name="SubStatus">0xc0000070</Data>
<Data Name="LogonType">5</Data>
<Data Name="LogonProcessName">Advapi </Data>
<Data Name="AuthenticationPackageName">Negotiate</Data>
<Data Name="WorkstationName">Y99WS</Data>
<Data Name="TransmittedServices">-</Data>
<Data Name="LmPackageName">-</Data>
<Data Name="KeyLength">0</Data>
<Data Name="ProcessId">0x230</Data>
<Data Name="ProcessName">C:\Windows\System32\services.exe</Data>
<Data Name="IpAddress">-</Data>
<Data Name="IpPort">-</Data>
</EventData>
</Event>
答案1
它似乎是 HKLM\System\CurrentControlSet\Control\LSA\crashonauditfail 注册表项。安全事件日志写满后，它被设置为 2，不允许非管理员登录机器，即使在清空日志后也是如此。