Event Log messages for failed logon attempts

From: Sean Warnock (swarnock_at_warnocksolutions.com)
Date: 10/25/03

  • Next message: Frank Heyne: "RE: Auditing enabled but Logon Failures not showing up" 
    Date: Sat, 25 Oct 2003 07:59:11 -0700
To: <FOCUS-MS@SECURITYFOCUS.COM>

           I am currently working on a small script that will parse the
    event logs of a Windows NT/2000/2003 domain controller looking for
    failed logon attempts. I am currently aware of event log message 529.
    I believe that I have been able to generate several other error messages
    for failed logon attempts depending upon what a client is using to
    authenticate with (ex. Kerberos, NTLM, etc...). Does anyone have any
    other input or articles that they would suggest as the only KB article
    that I have found so far was 299475.

    Sean

    ---------------------------------------------------------------------------
    FREE Whitepaper: Better Management for Network Security

    Looking for a better way to manage your IP security?
    Learn how Solsoft can help you:
    - Ensure robust IP security through policy-based management
    - Make firewall, VPN, and NAT rules interoperable across heterogeneous
    networks
    - Quickly respond to network events from a central console

    Download our FREE whitepaper at:
    http://www.securityfocus.com/sponsor/Solsoft_focus-ms_031015
    ---------------------------------------------------------------------------

  • Next message: Frank Heyne: "RE: Auditing enabled but Logon Failures not showing up"

    Relevant Pages

    • Re: How to automatic send an e-mail when an event occurs?
      ... CyberCop combines packet analysis with assessment of the event logs, ... environment, including security profiles, account groups, time and subnets. ... KSM is unable to terminate the intrusion or take actions such as logging ... As Windows NT and Windows 2000 are more fully deployed in environments ...
      (microsoft.public.windows.server.general)
    • RE: Event Log Monitor
      ... .Net Security Consultant ... > LANGUARD PRODUCTS - Security Log Monitor, ... > Event logs within a Windows enviroment. ... learn to recover trace data left behind by ...
      (Security-Basics)
    • Security Audits.
      ... I sent the following letter to our Anti-Virus support team; ... Windows security event logs becoming clogged and full of Failure audits of ... Event Source: Security ... the constantly filling event logs make for more frequent than ...
      (microsoft.public.windowsmedia)
    • RE: event viewer dont work fine
      ... Furthermore I've installed all MS Security bulletin Updates (using Windows ... Determine the dll responsible for registering this class object by ... If corrupt event logs are the problem, ... How to Delete Corrupt Event Viewer Log Files ...
      (microsoft.public.win2000.general)
    • Re: NTLM authentication fails randomly
      ... Nothing out of the ordinary appears in the Event Logs - although I do ... see Event ID 529 (unkown username or bad password) in the security ... and had them check IE's security ... Windows Authention" option had become unchecked!! ...
      (microsoft.public.inetserver.iis.security)