Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- Subject:
- Security ID: S-1-5-18
- Account Name: *********
- Account Domain: *********
- Logon ID: 0x3E7
- Logon Type: 2
- Account For Which Logon Failed:
- Security ID: S-1-0-0
- Account Name: *********
- Account Domain: EWNZ
- Failure Information:
- Failure Reason: Account locked out.
- Status: 0xC0000234
- Sub Status: 0x0
- Process Information:
- Caller Process ID: 0x9c8
- Caller Process Name: C:WindowsSystem32svchost.exe
- Network Information:
- Workstation Name: *********
- Source Network Address: 127.0.0.1
- Source Port: 0
- Detailed Authentication Information:
- Logon Process: User32
- Authentication Package: Negotiate
- Transited Services: -
- Package Name (NTLM only): -
- Key Length: 0
- This event is generated when a logon request fails. It is generated on the computer where access was
- attempted.
- The Subject fields indicate the account on the local system which requested the logon. This is most
- commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.
- The Logon Type field indicates the kind of logon that was requested. The most common types are 2
- (interactive) and 3 (network).
- The Process Information fields indicate which account and process on the system requested the logon.
- The Network Information fields indicate where a remote logon request originated. Workstation name is
- not always available and may be left blank in some cases.
- The authentication information fields provide detailed information about this specific logon request.
- - Transited services indicate which intermediate services have participated in this logon request.
- - Package name indicates which sub-protocol was used among the NTLM protocols.
- - Key length indicates the length of the generated session key. This will be 0 if no session key was
- requested.
- Subject:
- Security ID: S-1-5-18
- Account Name: *********
- Account Domain: *********
- Logon ID: 0x3E7
- Logon Type: 2
- Account For Which Logon Failed:
- Security ID: S-1-0-0
- Account Name: *********
- Account Domain: *********
- Failure Information:
- Failure Reason: Account locked out.
- Status: 0xC0000234
- Sub Status: 0x0
- Process Information:
- Caller Process ID: 0x9c8
- Caller Process Name: C:WindowsSystem32svchost.exe
- Network Information:
- Workstation Name: *********
- Source Network Address: 127.0.0.1
- Source Port: 0
- Detailed Authentication Information:
- Logon Process: User32
- Authentication Package: Negotiate
- Transited Services: -
- Package Name (NTLM only): -
- Key Length: 0
- This event is generated when a logon request fails. It is generated on the computer where access was
- attempted.
- The Subject fields indicate the account on the local system which requested the logon. This is most
- commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.
- The Logon Type field indicates the kind of logon that was requested. The most common types are 2
- (interactive) and 3 (network).
- The Process Information fields indicate which account and process on the system requested the logon.
- The Network Information fields indicate where a remote logon request originated. Workstation name is
- not always available and may be left blank in some cases.
- The authentication information fields provide detailed information about this specific logon request.
- - Transited services indicate which intermediate services have participated in this logon request.
- - Package name indicates which sub-protocol was used among the NTLM protocols.
- - Key length indicates the length of the generated session key. This will be 0 if no session key was
- requested.
Add Comment
Please, Sign In to add comment