[Servers] Tracing failed logons?

[Garacesh]

One of our members of SLT keeps repeatedly trying to log in, only to find his account is locked as per the current password policy.

We think this is student(s) trying their luck to guess his password.

 

Now according to websites like this one, this one, and this spiceworks discussion, all I need to do is put a policy on the domain controllers to enable Audit Logon Events for Failure

 

.. except I did that. Like three weeks ago.

 

[ATTACH=CONFIG]65013[/ATTACH]

 

There are zero events with the ID 4625 on any of our domain controllers. Ever. I can see 4624 Logon, 4672 Special Logon and 4634 Logoff but no 4625 Logon Denied

 

GPResult confirms the policy is applied to the domain controllers.

 

So what gives? Is there a new way of tracking failed logons? Am I going to have to write a Get-WinEvent script that checks every PC in the school one-by-one?

Edited March 17, 2022 by Garacesh

[Jamman960]

Event 4740 should list the computer that caused the lockout - are you getting these?

[Oaktech]

One of our members of SLT keeps repeatedly trying to log in, only to find his account is locked as per the current password policy.

We think this is student(s) trying their luck to guess his password.

 

Now according to websites like this one, this one, and this spiceworks discussion, all I need to do is put a policy on the domain controllers to enable Audit Logon Events for Failure

 

.. except I did that. Like three weeks ago.

 

[ATTACH=CONFIG]65013[/ATTACH]

 

There are zero events with the ID 4625 on any of our domain controllers. Ever. I can see 4624 Logon, 4672 Special Logon and 4634 Logoff but no 4625 Logon Denied

 

GPResult confirms the policy is applied to the domain controllers.

 

So what gives? Is there a new way of tracking failed logons? Am I going to have to write a Get-WinEvent script that checks every PC in the school one-by-one?

 

You needs yourself this...

 

https://www.netwrix.com/account_lockout_examiner.html

[psydii]

Its been a while since I looked but I think you need to use the advanced auditing tools:

 

https://docs.microsoft.com/en-us/archive/blogs/askds/global-object-access-auditing-is-magic

https://docs.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/audit-policy-recommendations

[6Foot2]

In our case this was happening, not because the students were making a "serious" attempt to login as members of staff (they really didn't need to make much effort with easy to guess passwords, passwords written down etc) it was a directed campaign to get senior staff to make Network Support lift the account lockout policy after multiple failed login attempts.

 

Sadly, despite my objections, it succeeded.

 

[Koldov]

I did this a long time ago and as @psydii mentioned, iirc I believe it is a function of the 'Advanced Audit Configuration'.

 

https://social.technet.microsoft.com/Forums/Azure/en-US/89abf0b3-3689-420f-b041-0ab491447e95/auditing-why-the-user-account-is-getting-locked-out?forum=winserverDS#:~:text=in%20to%20vote-,Hi%2C,-Thanks%20for%20your

 

Identify Source of Active Directory Account Lockouts: Troubleshooting

[Garacesh]

Event 4740 should list the computer that caused the lockout - are you getting these?

 

Yes, but the Caller Computer Name is simply \\WORKSTATION

 

A user account was locked out.

Subject:
Security ID:		SYSTEM
Account Name:		[color="#FF0000"]DC-NAME[/color]$
Account Domain:		[color="#FF0000"]DOMAIN[/color]
Logon ID:		0x3E7

Account That Was Locked Out:
Security ID:		[color="#FF0000"]DOMAIN[/color]\[color="#FF0000"]User[/color]
Account Name:		[color="#FF0000"]User[/color]

Additional Information:
Caller Computer Name:	\\WORKSTATION

[FragglePete]

We have ours on a task scheduler that looks for event 4740 and then send us an e-mail when it sees the lock out. It's been great in tracking down students who think it's fun to lock out a number of accounts from a specific PC. We do though unfortunately get a lot of notifications recently since enforcing complex passwords on all our students - but, we're hoping that will pass.

 

Pete

[Garacesh]

Its been a while since I looked but I think you need to use the advanced auditing tools:

 

https://docs.microsoft.com/en-us/archive/blogs/askds/global-object-access-auditing-is-magic

https://docs.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/audit-policy-recommendations

 

Aha, thank you for this.

I've added Audit Logon: Failure into the Advanced Audit Policy Configuration.

Now I guess I just wait for that to propagate out and test it.

 

Fingers crossed!

[Garacesh]

Well this is weird.

 

I can now see 4625 events, but most of them aren't showing me a username. The ones that are? Me. Only me. Which I think is timed out sessions on a server I know I'm still logged in to doing the whole 'we need your creds again pls' thing.

 

Everything else looks like this:

An account failed to log on.

Subject:
Security ID:		NULL SID
Account Name:		-
Account Domain:		-
Logon ID:		0x0

Logon Type:			3

Account For Which Logon Failed:
Security ID:		NULL SID
Account Name:		[color="#FF0000"]WIN-[i]A user that doesn't exist in AD[/i][/color]
Account Domain:		[color="#FF0000"]OURDOMAIN[/color]

Failure Information:
Failure Reason:		Unknown user name or bad password.
Status:			0xC000006D
Sub Status:		0xC0000064

Process Information:
Caller Process ID:	0x0
Caller Process Name:	-

Network Information:
Workstation Name:	[color="#FF0000"]WIN-[i]The same username as above[/i][/color]
Source Network Address:	[color="#FF0000"]A.Valid.IP.Address[/color]
Source Port:		49698

Detailed Authentication Information:
Logon Process:		NtLmSsp 
Authentication Package:	NTLM
Transited Services:	-
Package Name (NTLM only):	-
Key Length:		0

(Occasionally the Account Name and Workstation Name are genuine machines, but there's still no valid username in the information)

[Koldov]

Can't say for sure, but is it possible that someone tried to log on with an account name that isn't valid...?

 

Failure Reason: Unknown user name or bad password.

 

The classic 'which is it'... wrong username or wrong password...?

 

The only way you could know for sure is to maybe get a test account on a laptop and try logging in (or a random account that isn't real) and refresh the event log as you do it...?

 

Not a very technical solution, but it's hard trying to track down past events and why they happened, at least you could possibly see a real-time event and what it relates to...

 

EDIT: I'm not sure if it actually does log incorrect usernames... I'm sure I've seen them in the past, but haven't for a long time, might have to look into my auditing now... thanks...

Edited March 24, 2022 by Koldov

[Garacesh]

Perhaps, but there's a myriad of events all using different WIN- ID's. So I've no idea what's generating them.

 

I'm trying to chase down a user being periodically locked out of their account, which would insinuate there should be a bunch of failed logon events with his user name. It happened again today, so I went to check the DC's event logs, but there's no 4625 events with his user at all. On any of the DC's

[Koldov]

OK, so I now know why I'm not seeing what I used to see...

 

I think I remade my 'Advance Audit Policy Configuration' GPO for the Domain Controller at some point (I'm blaming Ping Castle)...

 

It didn't include what I remember, so I had another look and this is what I have now:

 

Advanced Audit Configuration
[b]Account Logon[/b]
[i]Policy Setting [/i]
Audit Kerberos Authentication Service Success, Failure 
Audit Kerberos Service Ticket Operations Success, Failure 

[b]Account Management[/b]
[i]Policy Setting [/i]
Audit Computer Account Management Success, Failure 
Audit Security Group Management Success, Failure 
Audit User Account Management Success, Failure 

[b]Detailed Tracking[/b]
[i]Policy Setting [/i]
Audit DPAPI Activity Success, Failure 
Audit Process Creation Success, Failure 

[b]Logon/Logoff[/b]
[i]Policy Setting [/i]
Audit Account Lockout Success, Failure 
Audit Logoff Success, Failure 
Audit Logon Success, Failure 
Audit Special Logon Success, Failure 

[b]Policy Change[/b]
[i]Policy Setting [/i]
Audit Authentication Policy Change Success, Failure 

[b]Privilege Use[/b]
[i]Policy Setting [/i]
Audit Sensitive Privilege Use Success, Failure 

[b]System[/b]
[i]Policy Setting [/i]
Audit Security System Extension Success, Failure 

 

Just tried and here's what I see now:

 

EVENT - 4768

 

A Kerberos authentication ticket (TGT) was requested.

Account Information:
Account Name:		[color="#FF0000"][b]test = NOT A REAL DOMAIN ACCOUNT[/b][/color]
Supplied Realm Name:	[color="#FF0000"][b]DOMAIN[/b][/color]
User ID:			NULL SID

Service Information:
Service Name:		krbtgt/[color="#FF0000"][b]DOMAIN[/b][/color]
Service ID:		NULL SID

Network Information:
Client Address:		::ffff:[color="#FF0000"][b]XX.XXX.XXX.XX = A VALID I.P[/b][/color]
Client Port:		49914

Additional Information:
Ticket Options:		0x40810010
Result Code:		0x6
Ticket Encryption Type:	0xFFFFFFFF
Pre-Authentication Type:	-

Certificate Information:
Certificate Issuer Name:		
Certificate Serial Number:	
Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.

 

Or... EVENT 4771

 

Kerberos pre-authentication failed.

Account Information:
Security ID:		[color="#FF0000"][b]DOMAIN\USER = A VAILD ACCOUNT[/b][/color]
Account Name:		[color="#FF0000"][b]USER[/b][/color]

Service Information:
Service Name:		krbtgt/[color="#FF0000"][b]DOMAIN[/b][/color]

Network Information:
Client Address:		::ffff:[color="#FF0000"][b]XX.XXX.XXX.XX = A VALID I.P.[/b][/color]
Client Port:		49908

Additional Information:
Ticket Options:		0x40810010
Failure Code:		0x18
Pre-Authentication Type:	2

Certificate Information:
Certificate Issuer Name:		
Certificate Serial Number: 	
Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options and failure codes are defined in RFC 4120.

If the ticket was malformed or damaged during transit and could not be decrypted, then many fields in this event might not be present.

 

EDIT: Just noticed that although I'm seeing these as Kerberos events, I'm not actually seeing any 4625, 4740 or any other Event I.D related to failed logon....

Edited March 24, 2022 by Koldov

[Koldov]

Sorry, that last edit was a lie... Event I.D. - 4740:

 

 

The Account Name, Account Domain, Security ID (domain/user) and Computer Name were all valid and correct...

[Garacesh]

Thank you @Koldov, I'll try tweaking some of those settings and see if it makes a difference. Much appreciated

[psydii]

Change the username (samaccountname, and UPN). Problem solved. The mystery, not so much.

[Garacesh]

Hmm... I'm seeing the lockout event now, which is good. But it's still not listing a device source properly.

 

A user account was locked out.

Subject:
Security ID:		SYSTEM
Account Name:		[color="#0000FF"]CurrentDC$[/color]
Account Domain:		[color="#0000FF"]Domain[/color]
Logon ID:		0x3E7

Account That Was Locked Out:
Security ID:		[color="#0000FF"]Domain[/color]\[color="#0000FF"]SLTAccount[/color]
Account Name:		[color="#0000FF"]SLTAccount[/color]

Additional Information:
Caller Computer Name:	[color="#FF0000"]\\WORKSTATION[/color]

 

All the 4625 events are either just myself or my tech, for some reason, and I'm not seeing any 4768 / A Kerberos authentication ticket (TGT) was requested. events for his account in the 15 minutes prior to the member of staff telling me he'd been locked out again.

[Koldov]

In mine the Account Name was the person's name, not the DC.

 

Could be that it is just posting the lockout (if PDC) as it was passed on from another DC, if you have any others can you check those?

 

Also, what do you mean by \\WORKSTATION...?

 

Is that what appears or is it blank?

 

What shows up when you lock out a test account?

 

A quick internet search suggest this list of various other reasons for no Caller Computer Name:

 

Check for services, scheduled tasks or software on lockout source machine

There could be outdated stored credentials an application making an LDAP call saved passwords in the credential manager. You can open up the credential manager on the system to verify there are no saved passwords on the system

Also check if any 3rd party device has a network drive or something connected to the server using wrong credentials etc

DNS and NetBIOS reverse lookup issue or computer/device not on domain

 

Or this...

 

https://www.reddit.com/r/sysadmin/wiki/lockouts#wiki_no_caller_computer_listed

[Garacesh]

Also, what do you mean by \\WORKSTATION...?

 

Is that what appears or is it blank?

As with before, that's literally what appears, verbatim.

 

I've had a quick play with Netwrix Account Lockout Examiner and that, too, picks up WORKSTATION as the device name.

I have confirmed there is no computer named WORKSTATION in our AD.

 

Edit: Going to steal a laptop after hours and lockout a test account

Edited March 28, 2022 by Garacesh

[Koldov]

Without knowing your full set-up and what services/roles your servers provide and what devices your staff have connected to them, only you are going to be able to narrow this down any further, but some more suggestions here:

 

https://community.spiceworks.com/topic/2213500-domain-user-account-lockout

 

https://www.reddit.com/r/activedirectory/comments/7ko0fa/account_lockouts_source_workstation/

 

I think those 'lockout' tools just read from the logs, so might not actually give you any more information than you already have (just makes it easier to view it all rather than manually searching)?

[slugshead]

Feel free to use/amend this code as required - run this on the station you want to audit. This is just looking for log on/log out events in the last 100 days but you could easily add the other event IDs and change the number of days.

 

Param (
[string]$Computer = (Read-Host Enter Computer Name),
[int]$Days = 100
)
cls
$Result = @()
Write-Host "Gathering Event Logs, this can take awhile..."
$ELogs = Get-EventLog System -Source Microsoft-Windows-WinLogon -After (Get-Date).AddDays(-$Days) -ComputerName $Computer
If ($ELogs)
{ Write-Host "Processing..."
ForEach ($Log in $ELogs)
{ If ($Log.InstanceId -eq 7001)
 { $ET = "Logon"
 }
 ElseIf ($Log.InstanceId -eq 7002)
 { $ET = "Logoff"
 }
 Else
 { Continue
 }
 $Result += New-Object PSObject -Property @{
  Time = $Log.TimeWritten
  'Event Type' = $ET
  User = (New-Object System.Security.Principal.SecurityIdentifier $Log.ReplacementStrings[1]).Translate([system.Security.Principal.NTAccount])
 }
}
$Result | Select Time,"Event Type",User | Sort Time -Descending | Out-GridView
Write-Host "Done."
}
Else
{ Write-Host "Problem with $Computer."
Write-Host "If you see a 'Network Path not found' error, try starting the Remote Registry service on that computer."
Write-Host "Or there are no logon/logoff events (XP requires auditing be turned on)"
}

 

Obvs this is only useful on a single computer and not showing domain wide logon attempts.

Edited March 28, 2022 by slugshead

[Garacesh]

Hmm, yep. Finally got around to doing a test lockout:

 

A user account was locked out.

Subject:
Security ID:		SYSTEM
Account Name:		[color="#0000FF"]DomainController$[/color]
Account Domain:		[color="#0000FF"]Domain[/color]
Logon ID:		0x3E7

Account That Was Locked Out:
Security ID:		[color="#0000FF"]Domain[/color]\[color="#0000FF"]User[/color]
Account Name:		[color="#0000FF"]User[/color]

Additional Information:
Caller Computer Name:	[color="#0000FF"]Device Name[/color]

 

So I'm inclined to agree with the post linked previously where they were saying \\WORKSTATION was a non-domain device like a phone/etc.

[KarlGoddard]

We had very similar issues when members of SMT hadn't updated their credentials in the Outlook / other mail app on their phones so after a forced network password change, which we do every term here, they were getting a temp lock out.

[Garacesh]

The thing that confuses me, though, is that this is in-domain activity.

 

We don't have RADIUS, so phones shouldn't be authenticating as a user. Which sucks, and I'd like to change that, but A) money and B) since nobody's device will pass traffic without the filter's SSL inspection certificate, and you can't get that without me personally putting it on your device, only staff get on the wifi (though they're filtered as pupils, since it's unauthenticated traffic)

 

A mail app wouldn't be talking to our DC's, and even then, our mail is with Google, so it can't even be any Azure AD shenanigans..

[Koldov]

A mail app wouldn't be talking to our DC's, and even then, our mail is with Google, so it can't even be any Azure AD shenanigans..

 

It might be red herring as that may not be a device, it may be service or mapped drive/resource...

 

For example, I have a weird error that I can't seem to get rid of as I use Outlook on my PC (and I remembered another reason I took off some of the auditing) and whenever I open outlook, one of my accounts (LGfL one from the account name in the error messages) hits my DC and produces loads of 4768 Audit Failure events (this happens a few times throughout the day as well).

 

It must have something to do with AutoDiscover, but I've done all sorts of registry tweaks to try and stop it (but failed) and I have no idea why Outlook on my computer hits up my DC for any kind of authentication (we don't use a local Exchange or anything like that).

 

It doesn't seem to be requesting a log-on and so isn't ever getting locked out (because there is no account to 'lock out') it's just a Kerberos ticket request, but just be aware that all sorts of things that 'talk' to the server and may use account credentials to try to log-on.

 

EDIT: Drove me mad at first trying to work out what it was and whether I'd used that email address to authenticate anything with, but it gives me my computer's I.P. address in Network Information and it happens everytime I log on to Outlook so...

Edited March 30, 2022 by Koldov