▲
26
Windows 4625 failed logon every morning at exactly the same time
Event 4625, same second every day, Logon Type 4, Sub Status 0xc000006a, caller process services.exe. Nothing appears broken. Is someone attacking us on a schedule?
Not an attack. That is a scheduled task with a stale password.
Type 4 is batch, so a task rather than a person. services.exe with Logon ID 0x3e7 is SYSTEM starting it locally. Source Network Address will be blank. And 0xc000006a is specifically wrong password, not unknown user.
Somebody rotated the account password and did not update the task. It will fail at the same time forever, and whatever the task was meant to do is not getting done.