Hi all, we have a remote probe which is monitoring the remote site with its own domain very well. We also have some Workgroup servers there, which are not domain joined. We configured a separate Windows Logon for a Workgroup server and the sensors are working well. The only thing: I see a windows security log event with id 4625 coming from the probe server every minute. As soon as i pause all sensors the log entry does not appear anymore. Do you guys have an idea why the probe is trying to connect to the workgroup server with a not existing user?

thanks in advance

Article Comments

Hi there,

Thank you for the post. Please let me know whether you have Sensors which are in the "Down" status? If not, please let me know if you are using the recommended Sensors feature: https://www.paessler.com/manuals/prtg/recommended_sensors This feature could cause the issue.


Jan, 2022 - Permalink

Hi Mortiz, thanks for your response. All sensors are up, so no sensors in "Down" status. Also on the overview tab I don't see a Recommended Sensors section. So I guess this feature is not in use.


Jan, 2022 - Permalink

Please validate that the feature is not used by navigating to "Setup > System Administration > Monitoring" If you have no Sensors in "Down" or "Unknown" status, the login works for all Sensors.

The only other feature which could cause logins is the "System Information" feature: https://www.paessler.com/manuals/prtg/system_information Therefore you can also try to deactivate this feature


Feb, 2022 - Permalink

Hi, we have about 5100 Sensors and the Setting for Recommended Sensor is on default. So i guess this one does not do anything.

i disabled the system information and all other stuff from Advanced Network Analysis. no change.


Feb, 2022 - Permalink

Hi there,

This is really strange. In this case, I would recommend to use the following script to check for the users uses in PRTG: https://helpdesk.paessler.com/en/support/solutions/articles/76000064806

Afterwards, you can check the users with the user failing and then identify the device which causes the issue.


Feb, 2022 - Permalink