PENDING SCCM Computer Account lockouts after upgrade from 2103 to 2207

[gc_sa]

Since I updated from version 2103 to version 2207 and applying the following Windows Updates to the Windows Server 2016 server: 09-2023 Cumulative Update, Service Stack Update and .NET Framework 4.8, I have been having regular account lockouts from the Computer Account. This is occurring on the CAS site and the secondary sites. Further details are as follows:

Running following roles on all servers:
Component Server
Distribution Point
Management Point
Site Database server
Site System
Software update point

The error (error ID 4625 in Security Logs) is as follows:
Security ID: SYSTEM
Account Name: [TheSCCMComputerName]$
Account Domain: [MyDomainName]
Logon ID: 0x3e7

Logon Type: 3

Account for Which Logon Failed:
Security ID: NULL SID
Account Name: (blank)
Account Domain: (blank)

Failure information:
Failure Reason: Unknown user name or bad password
Status: 0xC000006D
Sub Status: 0x0000064

Process Information:
Caller Process ID: 0x28c
Caller Process Name: C:\Windows\System32\lsass.exe

Network Information:
Workstation Name: [TheSCCMComputerName]
Source Network Address: (blank)
Source Port: (blank)

Detailed Authentication Information:
Logon Process: Schannel
Authentication Process: Kerberos
Transited Services: (blank)
Package Name (NTLM only): (blank)
Key Length: 0

Please help!

 

[Garth]

Since I updated from version 2103 to version 2207 and applying the following Windows Updates to the Windows Server 2016 server: 09-2023 Cumulative Update, Service Stack Update and .NET Framework 4.8, I have been having regular account lockouts from the Computer Account. This is occurring on the CAS site and the secondary sites. Further details are as follows:

Running following roles on all servers:
Component Server
Distribution Point
Management Point
Site Database server
Site System
Software update point

The error (error ID 4625 in Security Logs) is as follows:
Security ID: SYSTEM
Account Name: [TheSCCMComputerName]$
Account Domain: [MyDomainName]
Logon ID: 0x3e7

Logon Type: 3

Account for Which Logon Failed:
Security ID: NULL SID
Account Name: (blank)
Account Domain: (blank)

Failure information:
Failure Reason: Unknown user name or bad password
Status: 0xC000006D
Sub Status: 0x0000064

Process Information:
Caller Process ID: 0x28c
Caller Process Name: C:\Windows\System32\lsass.exe

Network Information:
Workstation Name: [TheSCCMComputerName]
Source Network Address: (blank)
Source Port: (blank)

Detailed Authentication Information:
Logon Process: Schannel
Authentication Process: Kerberos
Transited Services: (blank)
Package Name (NTLM only): (blank)
Key Length: 0

Please help!

Since you have a CAS and thereof over 150K of devices, I recommend that you contact MS support directly.

The event viewer message say logon failed. So what are you hoping for?

 

[gc_sa]

Hi Garth,

Apologies for my incorrect data, I confused CAS with the Primary site. I do not have a CAS in my environment.

Thanks!