Join Log in
Score:0
Niana avatar Server

Find network drive, program or artifact causing failed login

in flag
Niana

I am trying to tidy up an active directory situation on a network. One issue that exist is a user account is making a large number of log in attempts (500 ish) to a domain controller and failing cause of bad password.

I am using various tools such as ADAudit Plus that shows me the username, ip, and domain controller for the attempted login. I log in to the machine and there's no mapped drive, no network drive, no application I can see that's attempting to make this login from that machine. My question is, is there a way I can better locate the offending artifact to reduce this high number of failed login request?

Regards

22
0 + 0
cn flag
Greg Askew
On the host where the logons are occurring, review the security event log. When auditing is enabled, you should be able to correlate the logon with a process/id.
0
Reply
Niana avatar
in flag
Niana
I'm getting '0x0' for both Caller Process ID and Logon ID
0
Reply
Score:0
bjoster avatar Server
cn flag
bjoster

Look for event ID 5625.

The event 4625 is generated when a logon request fails and it is generated on the computer where access was attempted.

The Subject fields indicate the account on the local system which requested the logon (maybe 0x0). This is most commonly a service such as the (SMB-) Server service, or a local process such as Winlogon or Services.

The Logon Type field indicates the kind of logon that was requested. The most common types are:

  • 0 ("local system" account, usually used by local services)
  • 2 (interactive)
  • 3 (network)

The Process Information fields indicate which account and process on the system requested the logon (or has 0x0 as an indication for "local service"). "Key length" indicates the length of the generated session key. This will be 0 if no session key was requested (which points to a local service using local service's credentails wrong).

0 + 0
ธงชาติไทย
Elon Musk
I sit in a Tesla and translated this thread with Ai:

mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.