EVID 5805: Session Setup Failed To Authenticate

Vendor Documentation

https://kb.eventtracker.com/evtpass/evtpages/EventId_5805_NetLogon_47953.asp#:~:text=Event%20ID%20%2D%205805&text=A%20machine%20account%20failed%20to,replicated%20to%20every%20domain%20controller.

https://social.technet.microsoft.com/Forums/lync/en-US/aaa39867-fc79-4d9b-a260-6585a85a2f7b/event-ids-5805-and-5723-are-reported-in-the-system-event-log?forum=winserverDS

Log Fields and Parsing

This section details the log fields available in this log message type, along with values parsed for both LogRhythm Default and LogRhythm Default v2.0 policies. A value of "N/A" (not applicable) means that there is no value parsed for a specified log field.

Log Field	LogRhythm Default	LogRhythm Default v2.0
Provider	<process>	<tag2>
EventID Qualifiers	<vmid>	<vmid>
Version	N/A	N/A
Level	<severity>	<severity>
Task	N/A	<vendorinfo>
Opcode	N/A	N/A
Keywords	N/A	<result>
TimeCreated	N/A	N/A
EventRecordID	N/A	N/A
Correlation	N/A	N/A
Execution	N/A	N/A
Channel	N/A	N/A
Computer	N/A	<dname>
Security	N/A	N/A
Data	<dname>	<sname>
Data	<subject>	N/A
Binary	N/A	N/A

Log Processing Settings

This section details log processing changes made from the LogRhythm Default policy to LogRhythm Default v2.0. In some cases, base rules are broken down into sub-rules to appropriately parse log message types by their event types.

LogRhythm Default

Regex ID	Rule Name	Rule Type	Common Event	Classification
1008317	EVID 5805: Session Setup Failed To Authenticate	Base Rule	Authentication Failure Activity	Authentication Failure
1008317	EVID 5805: Session Auth Failed - Access Denied	Sub Rule	Computer Logon Failure	Authentication Failure

LogRhythm Default v2.0

Regex ID	Rule Name	Rule Type	Common Event	Classification
1012722	V 2.0 : EVID 5805: Authentication Failure Event	Base Rule	Authentication Failure Activity	Authentication Failure