First, I apologise if I selected a wrong thread for this question.
I receive lots of login failures on a DC for an account called as a domain. So obviously instead of a username, someone put there a domain name. And I'm trying to figure out the source of login failures and remediate it.
Please see blow Windows error messages:
> <13>May 30 09:07:43 192.168.1.1(<- IP address of a DC) AgentDevice=WindowsLog
> AgentLogFile=Security Source=Microsoft-Windows-Security-Auditing
> Computer=my_domain_controller.mydomain.local User= Domain= EventID=4625
> EventIDCode=4625 EventType=16 EventCategory=12544
> RecordNumber=1496134876135 TimeGenerated=1496134771119
> TimeWritten=1496134771119 Message=An account failed to log on.
> Subject: Security ID: S-1-0-0 Account Name: - Account Domain:
> - Logon ID: 0x0 Logon Type: 3 Account For Which Logon Failed: Security ID: S-1-0-0 Account Name: mydomain Account
> Domain: Failure Information: Failure Reason: %%2313 Status:
> 0xc000006d Sub Status: 0xc0000064 Process Information: Caller
> Process ID: 0x0 Caller Process Name: - Network Information:
> Workstation Name: Source Network Address: - Source Port: -
> Detailed Authentication Information: Logon Process: NtLmSsp
> Authentication Package: NTLM Transited Services: - Package Name
> (NTLM only): - Key Length: 0
> <13>May 30 09:07:43 192.168.1.1(<- IP address of a DC) AgentDevice=WindowsLog
> AgentLogFile=Security Source=Microsoft-Windows-Security-Auditing
> Computer=my_domain_controller.mydomain.local User= Domain= EventID=4776
> EventIDCode=4776 EventType=16 EventCategory=14336
> RecordNumber=1496134876135 TimeGenerated=1496134775413
> TimeWritten=1496134775413 Message=The computer attempted to
> validate the credentials for an account. Authentication Package:
> MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 Logon Account: mydomain
> Source Workstation: Error Code: 0xc0000064
In this logs, the source IP is DC's IP (it's OK though). But the 'Workstation Name' is empty. However, Logon Type: 3 indicates that it is a network logon. So I could not find where it comes from.
I thought that it might be an RDP connection over SSL/TLS, but in this case, NTLM should not be in use. Is that correct?
Or maybe these are authentication attempts over IIS? But why I have so few of information?
Or... So I really do not know what it could be and how to stop it.
Maybe some additional audit policy might give here more information?
Will enable additional "NTLM auditing", it maybe give me more information.
Any advice?