0

First, I apologise if I selected a wrong thread for this question.

I receive lots of login failures on a DC for an account called as a domain. So obviously instead of a username, someone put there a domain name. And I'm trying to figure out the source of login failures and remediate it.

Please see blow Windows error messages:

> <13>May 30 09:07:43 192.168.1.1(<- IP address of a DC) AgentDevice=WindowsLog
> AgentLogFile=Security    Source=Microsoft-Windows-Security-Auditing   
> Computer=my_domain_controller.mydomain.local    User=    Domain=    EventID=4625   
> EventIDCode=4625    EventType=16    EventCategory=12544   
> RecordNumber=1496134876135    TimeGenerated=1496134771119   
> TimeWritten=1496134771119    Message=An account failed to log on.   
> Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain: 
> -   Logon ID:  0x0    Logon Type:   3    Account For Which Logon Failed:   Security ID:  S-1-0-0   Account Name:  mydomain   Account
> Domain:      Failure Information:   Failure Reason:  %%2313   Status: 
> 0xc000006d   Sub Status:  0xc0000064    Process Information:   Caller
> Process ID: 0x0   Caller Process Name: -    Network Information:  
> Workstation Name:    Source Network Address: -   Source Port:  -   
> Detailed Authentication Information:   Logon Process:  NtLmSsp   
> Authentication Package: NTLM   Transited Services: -   Package Name
> (NTLM only): -   Key Length:  0



> <13>May 30 09:07:43 192.168.1.1(<- IP address of a DC) AgentDevice=WindowsLog
> AgentLogFile=Security    Source=Microsoft-Windows-Security-Auditing   
> Computer=my_domain_controller.mydomain.local    User=    Domain=    EventID=4776   
> EventIDCode=4776    EventType=16    EventCategory=14336   
> RecordNumber=1496134876135    TimeGenerated=1496134775413   
> TimeWritten=1496134775413    Message=The computer attempted to
> validate the credentials for an account.    Authentication Package:
> MICROSOFT_AUTHENTICATION_PACKAGE_V1_0  Logon Account: mydomain 
> Source Workstation:   Error Code: 0xc0000064

In this logs, the source IP is DC's IP (it's OK though). But the 'Workstation Name' is empty. However, Logon Type: 3 indicates that it is a network logon. So I could not find where it comes from.

I thought that it might be an RDP connection over SSL/TLS, but in this case, NTLM should not be in use. Is that correct?

Or maybe these are authentication attempts over IIS? But why I have so few of information?

Or... So I really do not know what it could be and how to stop it.

Maybe some additional audit policy might give here more information?

Will enable additional "NTLM auditing", it maybe give me more information.

Any advice?

9
  • what is computer.domain.com?
    – Fis
    May 30, 2017 at 10:39
  • Sorry, I didn't specify that it is a DC name.
    – MaxInt
    May 30, 2017 at 10:43
  • And isn't it enough to know the IP of the workstation?
    – Fis
    May 30, 2017 at 10:48
  • That is only IP address of the DC. I don't know IP of the workstation.
    – MaxInt
    May 30, 2017 at 10:49
  • A, I understand it now, so you didn't mask it in log. Its hard to find something in obfuscated log...
    – Fis
    May 30, 2017 at 10:50

0

You must log in to answer this question.