V 2.0 : EVID 4625 : Use Account Logon Failure
Vendor Documentation
Classification
Rule Name | Rule Type | Common Event | Classification |
|---|---|---|---|
| V 2.0 : EVID 4625 : Use Account Logon Failure | Base Rule | User Logon Failure | Authentication Failure |
| V 2.0 : Computer Account Logon Failure-Bad Usrname | Sub Rule | Computer Logon Failure | Authentication Failure |
| V 2.0 : Computer Account Logon Failure-Bad Pwd | Sub Rule | Computer Logon Failure | Authentication Failure |
| V 2.0 : Comp Acc Logon Failure - Expired Password | Sub Rule | Computer Logon Failure | Authentication Failure |
| V 2.0 : Comp Acc Logon Failure - Disabled Account | Sub Rule | Computer Logon Failure | Authentication Failure |
| V 2.0 : Comp Acc Logon Failure - Clock Out Of Sync | Sub Rule | Computer Logon Failure | Authentication Failure |
| V 2.0 : Comp Acc Logon Failure - Expired Account | Sub Rule | Computer Logon Failure | Authentication Failure |
| V 2.0 : Comp Acc Logon Failure - Password Change | Sub Rule | Computer Logon Failure | Authentication Failure |
| V 2.0 : Comp Acc Logon Failure - Locked Account | Sub Rule | Computer Logon Failure | Authentication Failure |
| V 2.0 : EVID 4625 : Computer Account Logon Failure | Sub Rule | Computer Logon Failure | Authentication Failure |
| V 2.0 : User Account Logon Failure - Bad Username | Sub Rule | User Logon Failure : Bad Username | Authentication Failure |
| V 2.0 : User Account Logon Failure - Bad Password | Sub Rule | User Logon Failure : Bad Password | Authentication Failure |
| V 2.0 : Usr Acc Logon Failure - Outside Logon Hrs | Sub Rule | User Logon Failure | Authentication Failure |
| V 2.0 : Usr Acc Logon FailureUnauth Workstation | Sub Rule | User Logon Failure | Authentication Failure |
| V 2.0 : Usr Acc Logon Failure - Expired Password | Sub Rule | User Logon Failure : Bad Password | Authentication Failure |
| V 2.0 : Usr Acc Logon Failure - Disabled Account | Sub Rule | User Logon Failure : Account Disabled | Authentication Failure |
| V 2.0 : Usr Acc Logon Failure - Clock Out Of Sync | Sub Rule | User Logon Failure | Authentication Failure |
| V 2.0 : Usr Acc Logon Failure - Expired Account | Sub Rule | User Logon Failure : Bad Username | Authentication Failure |
| V 2.0 : Usr Acc Logon FailurePwd Change Required | Sub Rule | User Logon Failure | Authentication Failure |
| V 2.0 : Usr Acc Logon Failure - Locked Account | Sub Rule | User Logon Failure : Account Locked Out | Authentication Failure |
| V 2.0 : EVID 4625 : User Logon Type 4: User Locked | Sub Rule | Authentication Failure Activity | Authentication Failure |
| V 2.0 : EVID 4625 : User Logon Type 9: User Locked | Sub Rule | Authentication Failure Activity | Authentication Failure |
| V 2.0 : EVID 4625 : Sys Logon Type 4: User Locked | Sub Rule | Computer Logon Failure | Authentication Failure |
| V 2.0 : EVID 4625 : Sys Logon Type 9: User Locked | Sub Rule | Computer Logon Failure | Authentication Failure |
| V 2.0 : EVID 4625 : Sys Logon Type 5: User Locked | Sub Rule | Service Logon Failure | Authentication Failure |
| V 2.0 : EVID 4625 : User Logon Type 5: User Locked | Sub Rule | Service Logon Failure | Authentication Failure |
| V 2.0 : EVID 4625 : Sys Logon Type 11:User Locked | Sub Rule | User Logon Failure : Account Locked Out | Authentication Failure |
| V 2.0 : EVID 4625 : Sys Logon Type 2:User Locked | Sub Rule | User Logon Failure : Account Locked Out | Authentication Failure |
| V 2.0 : EVID 4625 : Sys Logon Type 7:User Locked | Sub Rule | User Logon Failure : Account Locked Out | Authentication Failure |
| V 2.0 : EVID 4625 : Sys Logon Type 8:User Locked | Sub Rule | User Logon Failure : Account Locked Out | Authentication Failure |
| V 2.0 : EVID 4625 : Sys Logon Type 11:User Locked | Sub Rule | User Logon Failure : Account Locked Out | Authentication Failure |
| V 2.0 : EVID 4625 : Sys Logon Type 7:User Locked | Sub Rule | User Logon Failure : Account Locked Out | Authentication Failure |
| V 2.0 : EVID 4625 : Sys Logon Type 8:User Locked | Sub Rule | User Logon Failure : Account Locked Out | Authentication Failure |
| V 2.0 : EVID 4625 : Sys Logon Type 2:User Locked | Sub Rule | User Logon Failure : Account Locked Out | Authentication Failure |
| V 2.0 : EVID 4625 : Usr Logon Type 4: No Such User | Sub Rule | Authentication Failure Activity | Authentication Failure |
| V 2.0 : EVID 4625 : Usr Logon Type 9: No Such User | Sub Rule | Authentication Failure Activity | Authentication Failure |
| V 2.0 : EVID 4625 : User Logon Type 4: Wrong Pswd | Sub Rule | Authentication Failure Activity | Authentication Failure |
| V 2.0 : EVID 4625 : User Logon Type 9: Wrong Pswd | Sub Rule | Authentication Failure Activity | Authentication Failure |
| V 2.0 : EVID 4625 : Usr Logon Type 4: Bad Creden | Sub Rule | Authentication Failure Activity | Authentication Failure |
| V 2.0 : EVID 4625 : Usr Logon Type 9: Bad Credent | Sub Rule | Authentication Failure Activity | Authentication Failure |
| V 2.0 : EVID 4625 : Sys Logon Typ 4: No Such User | Sub Rule | Computer Logon Failure | Authentication Failure |
| V 2.0 : EVID 4625 : Sys Logon Typ 9: No Such User | Sub Rule | Computer Logon Failure | Authentication Failure |
| V 2.0 : EVID 4625 : System Logon Typ 4: Wrong Pswd | Sub Rule | Computer Logon Failure | Authentication Failure |
| V 2.0 : EVID 4625 : System Logon Typ 9: Wrong Pswd | Sub Rule | Computer Logon Failure | Authentication Failure |
| V 2.0 : EVID 4625 : Sys Logon Type 11: Bad Credent | Sub Rule | Computer Logon Failure | Authentication Failure |
| V 2.0 : EVID 4625 : Sys Logon Type 2: Bad Credent | Sub Rule | Computer Logon Failure | Authentication Failure |
| V 2.0 : EVID 4625 : Sys Logon Type 4: Bad Credent | Sub Rule | Computer Logon Failure | Authentication Failure |
| V 2.0 : EVID 4625 : Sys Logon Type 7: Bad Credent | Sub Rule | Computer Logon Failure | Authentication Failure |
| V 2.0 : EVID 4625 : Sys Logon Type 8: Bad Credent | Sub Rule | Computer Logon Failure | Authentication Failure |
| V 2.0 : EVID 4625 : Sys Logon Type 9: Bad Credent | Sub Rule | Computer Logon Failure | Authentication Failure |
| V 2.0 : EVID 4625 : Sys Logon Type 5: No Such User | Sub Rule | Service Logon Failure | Authentication Failure |
| V 2.0 : EVID 4625 : Usr Logon Type 5: No Such User | Sub Rule | Service Logon Failure | Authentication Failure |
| V 2.0 : EVID 4625 : Sys Logon Type 5: Wrong Pswd | Sub Rule | Service Logon Failure | Authentication Failure |
| V 2.0 : EVID 4625 : User Logon Type 5: Wrong Pswd | Sub Rule | Service Logon Failure | Authentication Failure |
| V 2.0 : EVID 4625 : Sys Logon Type 5: Bad Credent | Sub Rule | Service Logon Failure | Authentication Failure |
| V 2.0 : EVID 4625 : User Logon Type 5: Bad Credent | Sub Rule | Service Logon Failure | Authentication Failure |
| V 2.0 : EVID 4625 : Usr Logon Type 11: Bad Credent | Sub Rule | User Logon Failure | Authentication Failure |
| V 2.0 : EVID 4625 : User Logon Type 2: Bad Credent | Sub Rule | User Logon Failure | Authentication Failure |
| V 2.0 : EVID 4625 : User Logon Type 7: Bad Credent | Sub Rule | User Logon Failure | Authentication Failure |
| V 2.0 : EVID 4625 : User Logon Type 8: Bad Credent | Sub Rule | User Logon Failure | Authentication Failure |
| V 2.0 : EVID 4625 : Sys Logon Type 11 : Wrong Pswd | Sub Rule | User Logon Failure : Bad Password | Authentication Failure |
| V 2.0 : EVID 4625 : Sys Logon Type 2: Wrong Pswd | Sub Rule | User Logon Failure : Bad Password | Authentication Failure |
| V 2.0 : EVID 4625 : Sys Logon Type 7: Wrong Pswd | Sub Rule | User Logon Failure : Bad Password | Authentication Failure |
| V 2.0 : EVID 4625 : Sys Logon Type 8: Wrong Pswd | Sub Rule | User Logon Failure : Bad Password | Authentication Failure |
| V 2.0 : EVID 4625 : User Logon Type 11: Wrong Pswd | Sub Rule | User Logon Failure : Bad Password | Authentication Failure |
| V 2.0 : EVID 4625 : User Logon Type 2: Wrong Pswd | Sub Rule | User Logon Failure : Bad Password | Authentication Failure |
| V 2.0 : EVID 4625 : User Logon Type 7: Wrong Pswd | Sub Rule | User Logon Failure : Bad Password | Authentication Failure |
| V 2.0 : EVID 4625 : User Logon Type 8: Wrong Pswd | Sub Rule | User Logon Failure : Bad Password | Authentication Failure |
| V 2.0 : EVID 4625 : Sys Logon Type 11: No Such Usr | Sub Rule | User Logon Failure : Bad Username | Authentication Failure |
| V 2.0 : EVID 4625 : Sys Logon Type 2: No Such User | Sub Rule | User Logon Failure : Bad Username | Authentication Failure |
| V 2.0 : EVID 4625 : Sys Logon Type 7: No Such User | Sub Rule | User Logon Failure : Bad Username | Authentication Failure |
| V 2.0 : EVID 4625 : Sys Logon Type 8: No Such User | Sub Rule | User Logon Failure : Bad Username | Authentication Failure |
| V 2.0 : EVID 4625 : Usr Logon Typ 11: No Such User | Sub Rule | User Logon Failure : Bad Username | Authentication Failure |
| V 2.0 : EVID 4625 : User Logon Typ 2: No Such User | Sub Rule | User Logon Failure : Bad Username | Authentication Failure |
| V 2.0 : EVID 4625 : User Logon Typ 7: No Such User | Sub Rule | User Logon Failure : Bad Username | Authentication Failure |
| V 2.0 : EVID 4625 : User Logon Typ 8: No Such User | Sub Rule | User Logon Failure : Bad Username | Authentication Failure |
| V 2.0 : EVID 4625 : User Logon Type 4: Account Dis | Sub Rule | Authentication Failure Activity | Authentication Failure |
| V 2.0 : EVID 4625 : User Logon Type 9: Account Dis | Sub Rule | Authentication Failure Activity | Authentication Failure |
| V 2.0 : EVID 4625 : User Logon Type 4: Clock Out O | Sub Rule | Authentication Failure Activity | Authentication Failure |
| V 2.0 : EVID 4625 : User Logon Type 9: Clock Out O | Sub Rule | Authentication Failure Activity | Authentication Failure |
| V 2.0 : EVID 4625 : User Logon Type 4: No Logon Ri | Sub Rule | Authentication Failure Activity | Authentication Failure |
| V 2.0 : EVID 4625 : User Logon Type 9: No Logon Ri | Sub Rule | Authentication Failure Activity | Authentication Failure |
| V 2.0 : EVID 4625 : System Logon Type 4: Account D | Sub Rule | Computer Logon Failure | Authentication Failure |
| V 2.0 : EVID 4625 : System Logon Type 9: Account D | Sub Rule | Computer Logon Failure | Authentication Failure |
| V 2.0 : EVID 4625 : System Logon Type 2: Clock Out | Sub Rule | Computer Logon Failure | Authentication Failure |
| V 2.0 : EVID 4625 : System Logon Type 4: Clock Out | Sub Rule | Computer Logon Failure | Authentication Failure |
| V 2.0 : EVID 4625 : System Logon Type 7: Clock Out | Sub Rule | Computer Logon Failure | Authentication Failure |
| V 2.0 : EVID 4625 : System Logon Type 8: Clock Out | Sub Rule | Computer Logon Failure | Authentication Failure |
| V 2.0 : EVID 4625 : System Logon Type 9: Clock Out | Sub Rule | Computer Logon Failure | Authentication Failure |
| V 2.0 : EVID 4625 : System Logon Type 11: No Logon | Sub Rule | Computer Logon Failure | Authentication Failure |
| V 2.0 : EVID 4625 : System Logon Type 2: No Logon | Sub Rule | Computer Logon Failure | Authentication Failure |
| V 2.0 : EVID 4625 : System Logon Type 4: No Logon | Sub Rule | Computer Logon Failure | Authentication Failure |
| V 2.0 : EVID 4625 : System Logon Type 7: No Logon | Sub Rule | Computer Logon Failure | Authentication Failure |
| V 2.0 : EVID 4625 : System Logon Type 8: No Logon | Sub Rule | Computer Logon Failure | Authentication Failure |
| V 2.0 : EVID 4625 : System Logon Type 9: No Logon | Sub Rule | Computer Logon Failure | Authentication Failure |
| V 2.0 : EVID 4625 : System Logon Type 5: Account D | Sub Rule | Service Logon Failure | Authentication Failure |
| V 2.0 : EVID 4625 : User Logon Type 5: Account Dis | Sub Rule | Service Logon Failure | Authentication Failure |
| V 2.0 : EVID 4625 : System Logon Type 5: Clock Out | Sub Rule | Service Logon Failure | Authentication Failure |
| V 2.0 : EVID 4625 : User Logon Type 5: Clock Out O | Sub Rule | Service Logon Failure | Authentication Failure |
| V 2.0 : EVID 4625 : System Logon Type 5: No Logon | Sub Rule | Service Logon Failure | Authentication Failure |
| V 2.0 : EVID 4625 : User Logon Type 5: No Logon Ri | Sub Rule | Service Logon Failure | Authentication Failure |
| V 2.0 : EVID 4625 : User Logon Type 11: Clock Out | Sub Rule | User Logon Failure | Authentication Failure |
| V 2.0 : EVID 4625 : User Logon Type 2: Clock Out O | Sub Rule | User Logon Failure | Authentication Failure |
| V 2.0 : EVID 4625 : User Logon Type 7: Clock Out O | Sub Rule | User Logon Failure | Authentication Failure |
| V 2.0 : EVID 4625 : User Logon Type 8: Clock Out O | Sub Rule | User Logon Failure | Authentication Failure |
| V 2.0 : EVID 4625 : User Logon Type 11: No Logon R | Sub Rule | User Logon Failure | Authentication Failure |
| V 2.0 : EVID 4625 : User Logon Type 2: No Logon Ri | Sub Rule | User Logon Failure | Authentication Failure |
| V 2.0 : EVID 4625 : User Logon Type 7: No Logon Ri | Sub Rule | User Logon Failure | Authentication Failure |
| V 2.0 : EVID 4625 : User Logon Type 8: No Logon Ri | Sub Rule | User Logon Failure | Authentication Failure |
| V 2.0 : EVID 4625 : System Logon Type 11: Account | Sub Rule | User Logon Failure : Account Disabled | Authentication Failure |
| V 2.0 : EVID 4625 : System Logon Type 2: Account D | Sub Rule | User Logon Failure : Account Disabled | Authentication Failure |
| V 2.0 : EVID 4625 : System Logon Type 7: Account D | Sub Rule | User Logon Failure : Account Disabled | Authentication Failure |
| V 2.0 : EVID 4625 : System Logon Type 8: Account D | Sub Rule | User Logon Failure : Account Disabled | Authentication Failure |
| V 2.0 : EVID 4625 : User Logon Type 11: Account Di | Sub Rule | User Logon Failure : Account Disabled | Authentication Failure |
| V 2.0 : EVID 4625 : User Logon Type 2: Account Dis | Sub Rule | User Logon Failure : Account Disabled | Authentication Failure |
| V 2.0 : EVID 4625 : User Logon Type 7: Account Dis | Sub Rule | User Logon Failure : Account Disabled | Authentication Failure |
| V 2.0 : EVID 4625 : User Logon Type 8: Account Dis | Sub Rule | User Logon Failure : Account Disabled | Authentication Failure |
| V 2.0 : EVID 4625 : System Logon Type 11: Account | Sub Rule | User Logon Failure : Account Disabled | Authentication Failure |
| V 2.0 : EVID 4625 : System Logon Type 2: Account E | Sub Rule | User Logon Failure : Account Disabled | Authentication Failure |
| V 2.0 : EVID 4625 : System Logon Type 4: Account E | Sub Rule | Computer Logon Failure | Authentication Failure |
| V 2.0 : EVID 4625 : System Logon Type 5: Account E | Sub Rule | Service Logon Failure | Authentication Failure |
| V 2.0 : EVID 4625 : System Logon Type 7: Account E | Sub Rule | User Logon Failure : Account Disabled | Authentication Failure |
| V 2.0 : EVID 4625 : System Logon Type 8: Account E | Sub Rule | User Logon Failure : Account Disabled | Authentication Failure |
| V 2.0 : EVID 4625 : System Logon Type 9: Account E | Sub Rule | Computer Logon Failure | Authentication Failure |
| V 2.0 : EVID 4625 : User Logon Type 11: Account Ex | Sub Rule | User Logon Failure : Account Disabled | Authentication Failure |
| V 2.0 : EVID 4625 : User Logon Type 2: Account Exp | Sub Rule | User Logon Failure : Account Disabled | Authentication Failure |
| V 2.0 : EVID 4625 : User Logon Type 4: Account Exp | Sub Rule | Authentication Failure Activity | Authentication Failure |
| V 2.0 : EVID 4625 : User Logon Type 5: Account Exp | Sub Rule | Service Logon Failure | Authentication Failure |
| V 2.0 : EVID 4625 : User Logon Type 7: Account Exp | Sub Rule | User Logon Failure : Account Disabled | Authentication Failure |
| V 2.0 : EVID 4625 : User Logon Type 8: Account Exp | Sub Rule | User Logon Failure : Account Disabled | Authentication Failure |
| V 2.0 : EVID 4625 : User Logon Type 9: Account Exp | Sub Rule | Authentication Failure Activity | Authentication Failure |
| V 2.0 : EVID 4625 : System Logon Type 11: Change P | Sub Rule | User Logon Failure : Bad Password | Authentication Failure |
| V 2.0 : EVID 4625 : System Logon Type 2: Change Pa | Sub Rule | User Logon Failure : Bad Password | Authentication Failure |
| V 2.0 : EVID 4625 : System Logon Type 4: Change Pa | Sub Rule | Computer Logon Failure | Authentication Failure |
| V 2.0 : EVID 4625 : System Logon Type 5: Change Pa | Sub Rule | Service Logon Failure | Authentication Failure |
| V 2.0 : EVID 4625 : System Logon Type 7: Change Pa | Sub Rule | User Logon Failure : Bad Password | Authentication Failure |
| V 2.0 : EVID 4625 : System Logon Type 8: Change Pa | Sub Rule | User Logon Failure : Bad Password | Authentication Failure |
| V 2.0 : EVID 4625 : System Logon Type 9: Change Pa | Sub Rule | Computer Logon Failure | Authentication Failure |
| V 2.0 : EVID 4625 : User Logon Type 11: Change Pas | Sub Rule | User Logon Failure : Bad Password | Authentication Failure |
| V 2.0 : EVID 4625 : User Logon Type 2: Change Pass | Sub Rule | User Logon Failure : Bad Password | Authentication Failure |
| V 2.0 : EVID 4625 : User Logon Type 4: Change Pass | Sub Rule | User Logon Failure | Authentication Failure |
| V 2.0 : EVID 4625 : User Logon Type 5: Change Pass | Sub Rule | Service Logon Failure | Authentication Failure |
| V 2.0 : EVID 4625 : User Logon Type 7: Change Pass | Sub Rule | User Logon Failure : Bad Password | Authentication Failure |
| V 2.0 : EVID 4625 : User Logon Type 8: Change Pass | Sub Rule | User Logon Failure : Bad Password | Authentication Failure |
| V 2.0 : EVID 4625 : System Logon Type 11: Unknown | Sub Rule | Computer Logon Failure | Authentication Failure |
| V 2.0 : EVID 4625 : System Logon Type 2: Unknown R | Sub Rule | Computer Logon Failure | Authentication Failure |
| V 2.0 : EVID 4625 : System Logon Type 10: Unknown | Sub Rule | Computer Logon Failure | Authentication Failure |
| V 2.0 : EVID 4625 : System Logon Type 5: Unknown R | Sub Rule | Service Logon Failure | Authentication Failure |
| V 2.0 : EVID 4625 : System Logon Type 7: Unknown R | Sub Rule | Computer Logon Failure | Authentication Failure |
| V 2.0 : EVID 4625 : System Logon Type 8: Unknown R | Sub Rule | Computer Logon Failure | Authentication Failure |
| V 2.0 : EVID 4625 : System Logon Type 9: Unknown R | Sub Rule | Computer Logon Failure | Authentication Failure |
| V 2.0 : EVID 4625 : User Logon Type 10: Unknown Re | Sub Rule | User Logon Failure | Authentication Failure |
| V 2.0 : EVID 4625 : User Logon Type 11: Unknown Re | Sub Rule | User Logon Failure | Authentication Failure |
| V 2.0 : EVID 4625 : User Logon Type 2: Unknown Rea | Sub Rule | User Logon Failure | Authentication Failure |
| V 2.0 : EVID 4625 : User Logon Type 4: Unknown Rea | Sub Rule | Authentication Failure Activity | Authentication Failure |
| V 2.0 : EVID 4625 : User Logon Type 5: Unknown Rea | Sub Rule | Service Logon Failure | Authentication Failure |
| V 2.0 : EVID 4625 : User Logon Type 7: Unknown Rea | Sub Rule | User Logon Failure | Authentication Failure |
| V 2.0 : EVID 4625 : User Logon Type 8: Unknown Rea | Sub Rule | User Logon Failure | Authentication Failure |
| V 2.0 : EVID 4625 : User Logon Type 9: Unknown Rsn | Sub Rule | Authentication Failure Activity | Authentication Failure |
Mapping with LogRhythm Schema
| Device Key in Log Message | LogRhythm Schema | Data Type | Schema Description |
|---|---|---|---|
| Provider | N/A | N/A | Identifies the provider that logged the event. The Name and GUID attributes are included if the provider used an instrumentation manifest to define its events. The EventSourceName attribute is included if a legacy event provider (using the Event Logging API) logged the event. |
| EventID | <vmid> | Number | The identifier that the provider used to identify the event. |
| Version | N/A | N/A | The version number of the event's definition. |
| Level | <severity> | Text/String | The severity level defined in the event. |
| Task | <vendorinfo> | Text/String | The task defined in the event. Task and Opcode are typically used to identify the location in the application from where the event was logged. |
| Opcode | N/A | N/A | The opcode defined in the event. Task and Opcode are typically used to identify the location in the application from where the event was logged. |
| Keywords | <result> | Text/String | A bitmask of the keywords defined in the event. Keywords are used to classify types of events (for example, events associated with reading data). |
| TimeCreated | N/A | N/A | The time stamp that identifies when the event was logged. The time stamp will include either the SystemTime attribute or the RawTime attribute. |
| EventRecordID | N/A | N/A | The record number assigned to the event when it was logged. |
| Correlation | N/A | N/A | The activity identifiers that consumers can use to group related events together. |
| Execution | N/A | N/A | Contains information about the process and thread that logged the event. |
| Channel | N/A | N/A | The channel to which the event was logged. |
| Computer | <dname> | Text/String | The name of the computer on which the event occurred. |
| SubjectUserSid | N/A | N/A | The SID of account that reported information about logon failure. |
| SubjectUserName | N/A | N/A | The name of the account that reported information about logon failure. |
| SubjectDomainName | N/A | N/A | The subject's domain or computer name. Formats vary, and include the following:
|
| SubjectLogonId | N/A | N/A | A hexadecimal value that can help you correlate this event with recent events that might contain the same Logon ID. |
| TargetUserSid | N/A | N/A | The SID of the account that was specified in the logon attempt. |
| TargetUserName | <login> <tag1> | Text/String | The name of the account that was specified in the logon attempt. |
| TargetDomainName | <domainorigin> | Text/String | The target's domain or computer name. Formats vary, and include the following:
|
| Status | <responsecode><tag2> | Text/String | The reason why logon failed. |
| FailureReason | <reason> | Text/String/Number | The textual explanation of Status field value. |
| SubStatus | <status> | Text/String | Additional information about logon failure. |
| LogonType | <sessiontype> <tag3> | Number | The type of logon which was performed. |
| LogonProcessName | <object> | Text/String | The name of the trusted logon process that was used for the logon attempt. |
| AuthenticationPackageName | <objectname> | Text/String | The name of the authentication package which was used for the logon authentication process. The most common authentication packages are:
|
| WorkstationName | <sname> | Text/String | The machine name to which logon attempt was performed. |
| TransmittedServices | N/A | N/A | The list of transmitted services. Transmitted services are populated if the logon was a result of a S4U (Service For User) logon process. S4U is a Microsoft extension to the Kerberos Protocol to allow an application service to obtain a Kerberos service ticket on behalf of a user – most commonly done by a front-end website to access an internal resource on behalf of a user. |
| LmPackageName | <objecttype> | String | The name of the LAN Manager sub-package (NTLM-family protocol name) that was used during logon. Possible values are:
Only populated if Authentication Package = NTLM. |
| KeyLength | <size> | Number | The length of NTLM Session Security key. Typically it has 128 bit or 56 bit length. This parameter is always 0 if Authentication Package = Kerberos, because it is not applicable for Kerberos protocol. This field will also have 0 value if Kerberos was negotiated using Negotiate authentication package. |
| ProcessId | <processid> | Number | A hexadecimal Process ID of the process that attempted the logon. Process ID (PID) is a number used by the operating system to uniquely identify an active process. |
| ProcessName | <process> | Text/String | The full path and the name of the executable for the process. |
| IpAddress | <sip> | IP Address | The IP address of machine from which logon attempt was performed. IPv6 address or ::ffff:IPv4 address of a client. ::1 or 127.0.0.1 means localhost. |
| IpPort | <sport> | Number | The source port which was used for logon attempt from remote machine. 0 for interactive logons. |