0

First, I apologise if I selected a wrong thread for this question.

I receive lots of login failures on a DC for an account called as a domain. So obviously instead of a username, someone put there a domain name. And I'm trying to figure out the source of login failures and remediate it.

Please see blow Windows error messages:

> <13>May 30 09:07:43 192.168.1.1(<- IP address of a DC) AgentDevice=WindowsLog
> AgentLogFile=Security    Source=Microsoft-Windows-Security-Auditing   
> Computer=my_domain_controller.mydomain.local    User=    Domain=    EventID=4625   
> EventIDCode=4625    EventType=16    EventCategory=12544   
> RecordNumber=1496134876135    TimeGenerated=1496134771119   
> TimeWritten=1496134771119    Message=An account failed to log on.   
> Subject:   Security ID:  S-1-0-0   Account Name:  -   Account Domain: 
> -   Logon ID:  0x0    Logon Type:   3    Account For Which Logon Failed:   Security ID:  S-1-0-0   Account Name:  mydomain   Account
> Domain:      Failure Information:   Failure Reason:  %%2313   Status: 
> 0xc000006d   Sub Status:  0xc0000064    Process Information:   Caller
> Process ID: 0x0   Caller Process Name: -    Network Information:  
> Workstation Name:    Source Network Address: -   Source Port:  -   
> Detailed Authentication Information:   Logon Process:  NtLmSsp   
> Authentication Package: NTLM   Transited Services: -   Package Name
> (NTLM only): -   Key Length:  0



> <13>May 30 09:07:43 192.168.1.1(<- IP address of a DC) AgentDevice=WindowsLog
> AgentLogFile=Security    Source=Microsoft-Windows-Security-Auditing   
> Computer=my_domain_controller.mydomain.local    User=    Domain=    EventID=4776   
> EventIDCode=4776    EventType=16    EventCategory=14336   
> RecordNumber=1496134876135    TimeGenerated=1496134775413   
> TimeWritten=1496134775413    Message=The computer attempted to
> validate the credentials for an account.    Authentication Package:
> MICROSOFT_AUTHENTICATION_PACKAGE_V1_0  Logon Account: mydomain 
> Source Workstation:   Error Code: 0xc0000064

In this logs, the source IP is DC's IP (it's OK though). But the 'Workstation Name' is empty. However, Logon Type: 3 indicates that it is a network logon. So I could not find where it comes from.

I thought that it might be an RDP connection over SSL/TLS, but in this case, NTLM should not be in use. Is that correct?

Or maybe these are authentication attempts over IIS? But why I have so few of information?

Or... So I really do not know what it could be and how to stop it.

Maybe some additional audit policy might give here more information?

Will enable additional "NTLM auditing", it maybe give me more information.

Any advice?

migrated from security.stackexchange.com May 30 '17 at 16:28

This question came from our site for information security professionals.

  • what is computer.domain.com? – Fis May 30 '17 at 10:39
  • Sorry, I didn't specify that it is a DC name. – MaxInt May 30 '17 at 10:43
  • And isn't it enough to know the IP of the workstation? – Fis May 30 '17 at 10:48
  • That is only IP address of the DC. I don't know IP of the workstation. – MaxInt May 30 '17 at 10:49
  • A, I understand it now, so you didn't mask it in log. Its hard to find something in obfuscated log... – Fis May 30 '17 at 10:50

Your Answer

By clicking "Post Your Answer", you agree to our terms of service, privacy policy and cookie policy