| Solution | This status code simply indicates that the login username is found on the FortiAuthenticator database, but does not match the password, which is locally stored on the Windows machine. This usually happens when a local credential is used with a mismatched password on both FortiAuthenticator and the local Windows machine. To resolve this issue, just reset the password on FortiAuthenticator or the local Windows machine. Hereby is the sample event logs downloaded from the FortiAuthenticator Windows agent (local credential/account of 'test' with '.\' representing 'this local computer'): 2025-12-12 08:39:06,429 [7684|2132|DEBUG] : [Credential.cpp:4964] Credential::GetTokenInfo
2025-12-12 08:39:06,444 [7684|2132|DEBUG] : [Credential.cpp:182] Windows::Version: Windows 11 Pro 24H2 26100.6899
2025-12-12 08:39:06,445 [7684|2132|INFO ] : [Provider.cpp:422] Provider::SetUsageScenario(CPUS_LOGON, 0x00000000)
2025-12-12 08:39:06,453 [7684|2132|DEBUG] : [Provider.cpp:545] Provider::Advise(000002750A3878C0, 000000000000000D) - provider events callback reference added
2025-12-12 08:39:06,492 [7684|2132|DEBUG] : [Provider.cpp:961] Provider::GetCredentialCount: Enumerated 2 credentials
2025-12-12 08:39:17,902 [7684|2132|INFO ] : [Credential.cpp:2461] Credential::GetSerialization: Processing login for .\test. Service is running
2025-12-12 08:39:17,902 [7684|2132|INFO ] : [Credential.cpp:2511] Credential::GetSerialization: Exempt user (username: test, domain: .:( allow bypass
2025-12-12 08:39:17,916 [7684|2132|DEBUG] : [Credential.cpp:2606] Credential::GetSerialization: Usage Scenario is CPUS_LOGON
2025-12-12 08:39:17,922 [7684|2132|INFO ] : [Credential.cpp:2726] Credential::ReportResult(0xc000006d, 0x00000000) called
2025-12-12 08:39:24,319 [7684|2132|INFO ] : [Credential.cpp:2461] Credential::GetSerialization: Processing login for .\test. Service is running
2025-12-12 08:39:24,319 [7684|2132|INFO ] : [Credential.cpp:2511] Credential::GetSerialization: Exempt user (username: test, domain: .:( allow bypass
2025-12-12 08:39:24,322 [7684|2132|DEBUG] : [Credential.cpp:2606] Credential::GetSerialization: Usage Scenario is CPUS_LOGON
2025-12-12 08:39:24,339 [7684|2132|INFO ] : [Credential.cpp:2726] Credential::ReportResult(0xc000006d, 0x00000000) called
2025-12-12 08:39:54,972 [7684|2132|INFO ] : [Credential.cpp:2461] Credential::GetSerialization: Processing login for LOCAL\test. Service is running
2025-12-12 08:39:54,972 [7684|2132|INFO ] : [Credential.cpp:2511] Credential::GetSerialization: Exempt user (username: test, domain: LOCAL): allow bypass
2025-12-12 08:39:54,972 [7684|2132|DEBUG] : [Credential.cpp:2606] Credential::GetSerialization: Usage Scenario is CPUS_LOGON
2025-12-12 08:39:55,042 [7684|2132|INFO ] : [Credential.cpp:2726] Credential::ReportResult(0xc000006d, 0x00000000) called
2025-12-12 08:40:07,512 [7684|2132|DEBUG] : [Provider.cpp:556] Provider::UnAdvise - provider events callback reference released |
