Failed logon event generated when running remote WMI command

Article ID: 2816192 - View products that this article applies to.
Expand all | Collapse all


Consider the following scenario:
  • You have two or more computers running Windows.
  • The computers are setup in a workgroup or domain environment.
  • You run a remote WMI query using an application that makes WMI calls from one computer to another computer.

In this scenario, if you review the Security log on the remote computer you will notice an Event ID 4625 with regards to failure audit events for failed logon with bad username or password. You will also note that subsequently there is a successful logon with the credentials specified on the remote WMI query.


This is due to the fact that pass-through authentication is always attempted first even if specific credentials are specified in the tool being used.


You can safely ignore the error message.

More information

Note This is a "FAST PUBLISH" article created directly from within the Microsoft support organization. The information contained herein is provided as-is in response to emerging issues. As a result of the speed in making it available, the materials may include typographical errors and may be revised at any time without notice. See Terms of Use for other considerations.


Article ID: 2816192 - Last Review: February 18, 2013 - Revision: 4.0
Applies to
  • Windows 7 Enterprise
  • Windows 7 Home Basic
  • Windows 7 Home Premium
  • Windows 7 Professional
  • Windows 7 Ultimate
  • Windows Server 2008 R2 Datacenter
  • Windows Server 2008 R2 Enterprise
  • Windows Server 2008 R2 Foundation
  • Windows Server 2008 R2 Standard
  • Windows Vista Business
  • Windows Vista Enterprise
  • Windows Vista Home Basic
  • Windows Vista Home Premium
  • Windows Vista Ultimate
  • Windows Server 2008 Datacenter
  • Windows Server 2008 Enterprise
  • Windows Server 2008 Standard

Give Feedback


Contact us for more help

Contact us for more help
Connect with Answer Desk for expert help.
Get more support from