Link to home
Start Free TrialLog in
Avatar of Larry Kiterling
Larry Kiterling

asked on

Login attempt - Need help identifying

I received this from my vulnerability scan company and wanted some assistance in identifying.

Win08. GFL. Logon Failure: Unknown username or bad password. Event Id:4625. An account failed to log on.. Subject:. Security ID:S-1-5-18. Account Name:WIL-FUNTIME$. Account Domain:EXPERTEXCHANGE. Logon ID:0x3e7. Logon Type:8. Account For Which Logon Failed:. Security ID:S-1-0-0. Account Name:test. Account Domain:. Failure Information:. Failure Reason:Unknown user name or bad password.. Status:0xc000006d. Sub Status:0xc0000064. Process Information:. Caller Process ID:0x708. Caller Process Name:C:\Windows\System32\svchost.exe. Network Information:. Workstation Name:WIL-FUNTIME. Source Network Address:-. Source Port:-. Detailed Authentication Information:. Logon Process:Advapi . Authentication Package:MICROSOFT_AUTHENTICATION_PACKAGE_V1_0. Transited Services:-. Package Name (NTLM only):-. Key Length:0. This event is generated when a logon request fails. It is generated on the computer where access was attempted.. The Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service or a local process such as Winlogon.exe or Services.exe.. The Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).. The Process Information fields indicate which account and process on the system requested the logon.. The Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.. The authentication information fields provide detailed information about this specific logon request.. - Transited services indicate which intermediate services have participated in this logon request.. - Package name indicates which sub-protocol was used among the NTLM protocols.. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Avatar of Will Szymkowski
Will Szymkowski
Flag of Canada image

I would suggest that you use Active Directory Auditor by Lepide Software. This will give you good insight on where the account is being locked out from.

Active Directory Auditor by Lepide Software
http://www.lepide.com/lepideauditor/active-directory-auditing.html

Will.
Avatar of Larry Kiterling
Larry Kiterling

ASKER

Can you give me any directions on what I need to investigate?
ASKER CERTIFIED SOLUTION
Avatar of Rakesh Kapoor
Rakesh Kapoor

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Even better,
Can someone summarize what the error states? I actually don't need to investigate any further just a summary of the event above. Thanks!
In your network some computer is sending authentication request, which is getting failed. It could be any virrus or any process.

Did you change any password of any service account after which you started getting these alerts.

In old comments, I shared list to tools to identify detailed information about the source computer.

Hope this explanation would be helpful.
Is this a authentication request from another PC trying to access WIL-FUNTIME or is is WIL-FUNTIME attempting to access a PC?
Account Name:WIL-FUNTIME$. Account Domain:EXPERTEXCHANGE is trying to access the computer. Is this a Service account? Did you recently change password of this account???

What is this account for??
WIL-FUNTIME is the actual computer name. Does that mean it tried to authenticate against itself?
Do i need to install this tool on the AD or on WIL-FUNTIME?