Re: Pre-authentication events logged, but not lock-out or auth failure

Hi
Read this:
http://www.eventid.net/display.asp?e...curity&phase=1

--
I hope that the information above helps you.
Have a Nice day.
Jorge Silva
MVP Directory Services

Please no e-mails, any questions should be posted in the NewsGroup
This posting is provided "AS IS" with no warranties, and confers no rights.



"cmhnz" <> wrote in message
news:...
>
> Hi all,
>
> We've discovered that we are not receiving any event ID's 529, 531, 532
> or 544 on our domain controllers. These identify username/password
> failure, account expired/disabled/locked out.
>
> Instead, we're receiving pre-authentication failure events (ID 675)
> with various Failure Codes which identify what the failure relates to.
> This started happening a couple of months ago but has only just come to
> light, and we're unsure why. Failed logon attempts directly to the
> domain controllers are logged with the specific ID (529 etc), but are
> logged as ID 675 on any other workstation/server on the domain.
>
> To my knowledge, no changes were implemented when this started
> occurring, and although it appears failed logons are getting logged as
> pre-authentication failures, this isn't ideal as we use GFI
> EventsManager to report on failed logins and really need the events
> logged as their specific ID's (529, 531 etc).
>
> Any help greatly appreciated.
>
> Cheers,
> Chris
>
>
> --
> cmhnz
> ------------------------------------------------------------------------
> cmhnz's Profile: http://forums.techarena.in/members/151326.htm
> View this thread: http://forums.techarena.in/active-directory/1266595.htm
>
> http://forums.techarena.in
>