When reviewing the security logs for one of my DC's, I noticed an Unknown username or bad password failed attempt for an account. On the DC, the security log shows that it generated 130 attempts within a few minutes. I connected to the worksation to review the security logs and saw no failed attempts. I did see the account logon, but it was a few minutes before the logs on the DC showed the failed attempts.
It shows that the logon type was 2 (interactive), and it has an551 (user initiated logoff) that follows 20min after, making it almost 99.9% sure that a user logged on with the account and clicked log off.
How could 130 attempts appear on a DC log while the workstation shows no traces (the log has not been cleared within the past 2 years)
