Article ID: 2816192 - View products that this article applies to.
Consider the following scenario:
In this scenario, if you review the Security log on the remote computer you will notice an Event ID 4625 with regards to failure audit events for failed logon with bad username or password. You will also note that subsequently there is a successful logon with the credentials specified on the remote WMI query.
This is due to the fact that pass-through authentication is always attempted first even if specific credentials are specified in the tool being used.
(http://go.microsoft.com/fwlink/?LinkId=151500)for other considerations.
Article ID: 2816192 - Last Review: February 18, 2013 - Revision: 4.0