Failed logon event generated when running remote WMI command
This article describes an issue where a failed logon event is generated when you run remote WMI command.
Original product version: Windows 7 Service Pack 1, Windows Server 2012 R2
Original KB number: 2816192
Consider the following scenario:
- You've two or more computers running Windows.
- The computers are set up in a workgroup or domain environment.
- You run a remote WMI query using an application that makes WMI calls from one computer to another computer.
In this scenario, if you review the Security log on the remote computer, you'll notice an Event ID 4625 that's for a failed logon with bad username or password. You'll also note then there's a successful logon with the credentials specified on the remote WMI query.
The pass-through authentication is always attempted first, even if specific credentials are specified in the tool being used.
You can safely ignore the error message.