mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-06-15 10:23:37 +00:00
Merge pull request #3614 from TimShererWithAquent/us1610820k
1610820: Edit descriptions for SEO (11 of 11)
This commit is contained in:
Gary Moore
GitHub
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Configure Hybrid Windows Hello for Business key trust Settings
|
||||
description: Configuring Windows Hello for Business settings in hybrid key trust deployment.
|
||||
description: Begin the process of configuring your hybrid key trust environment for Windows Hello for Business. Start with your Active Directory configuration.
|
||||
keywords: identity, PIN, biometric, Hello, passport, WHFB, hybrid, certificate-trust
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
title: Windows Hello for Business Overview (Windows 10)
|
||||
ms.reviewer: An overview of Windows Hello for Business
|
||||
description: An overview of Windows Hello for Business
|
||||
description: Learn how Windows Hello for Business replaces passwords with strong two-factor authentication on PCs and mobile devices in Windows 10.
|
||||
keywords: identity, PIN, biometric, Hello, passport
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Planning a Windows Hello for Business Deployment
|
||||
description: A guide to planning a Windows Hello for Business deployment
|
||||
description: Learn about the role of each component within Windows Hello for Business and how certain deployment decisions affect other aspects of your infrastructure.
|
||||
keywords: identity, PIN, biometric, Hello, passport
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Windows Hello for Business Videos
|
||||
description: Windows Hello for Business Videos
|
||||
description: View several informative videos describing features and experiences in Windows Hello for Business in Windows 10.
|
||||
keywords: identity, PIN, biometric, Hello, passport, video, watch, passwordless
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Passwordless Strategy
|
||||
description: Reducing Password Usage Surface
|
||||
description: Learn about the password-less strategy and how Windows Hello for Business implements this strategy in Windows 10.
|
||||
keywords: identity, PIN, biometric, Hello, passport, video, watch, passwordless
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: How to configure Diffie Hellman protocol over IKEv2 VPN connections (Windows 10)
|
||||
description: Explains how to secure VPN connections for Diffie Hellman Group 2
|
||||
description: Learn how to update the Diffie Hellman configuration of VPN servers and clients by running VPN cmdlets to secure connections.
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: VPN authentication options (Windows 10)
|
||||
description: tbd
|
||||
description: Learn about the EAP authentication methods that Windows supports in VPNs to provide secure authentication using username/password and certificate-based methods.
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: VPN auto-triggered profile options (Windows 10)
|
||||
description: tbd
|
||||
description: Learn about the types of auto-trigger rules for VPNs in Windows 10, which start a VPN when it is needed to access a resource.
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
@ -61,13 +61,15 @@ When the trigger occurs, VPN tries to connect. If an error occurs or any user in
|
||||
|
||||
When a device has multiple profiles with Always On triggers, the user can specify the active profile in **Settings** > **Network & Internet** > **VPN** > *VPN profile* by selecting the **Let apps automatically use this VPN connection** checkbox. By default, the first MDM-configured profile is marked as **Active**. Devices with multiple users have the same restriction: only one profile and therefore only one user will be able to use the Always On triggers.
|
||||
|
||||
Preserving user Always On preference
|
||||
## Preserving user Always On preference
|
||||
|
||||
Windows has a feature to preserve a user’s AlwaysOn preference. In the event that a user manually unchecks the “Connect automatically” checkbox, Windows will remember this user preference for this profile name by adding the profile name to the value AutoTriggerDisabledProfilesList.
|
||||
Should a management tool remove/add the same profile name back and set AlwaysOn to true, Windows will not check the box if the profile name exists in the below registry value in order to preserve user preference.
|
||||
Key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RasMan\Config
|
||||
Value: AutoTriggerDisabledProfilesList
|
||||
Type: REG_MULTI_SZ
|
||||
Windows has a feature to preserve a user’s AlwaysOn preference. In the event that a user manually unchecks the “Connect automatically” checkbox, Windows will remember this user preference for this profile name by adding the profile name to the value **AutoTriggerDisabledProfilesList**.
|
||||
|
||||
Should a management tool remove or add the same profile name back and set **AlwaysOn** to **true**, Windows will not check the box if the profile name exists in the following registry value in order to preserve user preference.
|
||||
|
||||
**Key:** HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RasMan\Config<br/>
|
||||
**Value:** AutoTriggerDisabledProfilesList<br/>
|
||||
**Type:** REG_MULTI_SZ
|
||||
|
||||
|
||||
## Trusted network detection
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Windows 10 VPN technical guide (Windows 10)
|
||||
description: Use this guide to configure VPN deployment for Windows 10.
|
||||
description: Learn about decisions to make for Windows 10 clients in your enterprise VPN solution and how to configure your deployment.
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: VPN name resolution (Windows 10)
|
||||
description: tbd
|
||||
description: Learn how the name resolution setting in the VPN profile configures how name resolution works when a VPN client connects to a VPN server.
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: VPN routing decisions (Windows 10)
|
||||
description: tbd
|
||||
description: Learn about approaches that either send all data through a VPN or only selected data. The one you choose impacts capacity planning and security expectations.
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: VPN security features (Windows 10)
|
||||
description: tbd
|
||||
description: Learn about security features for VPN, including LockDown VPN, Windows Information Protection integration with VPN, and traffic filters.
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: BitLocker Management Recommendations for Enterprises (Windows 10)
|
||||
description: This topic explains recommendations for managing BitLocker.
|
||||
description: Refer to relevant documentation, products, and services to learn about managing BitLocker for enterprises and see recommendations for different computers.
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: explore
|
||||
ms.sitesec: library
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Appendix A, Security monitoring recommendations for many audit events (Windows 10)
|
||||
description: Appendix A, Security monitoring recommendations for many audit events
|
||||
description: Learn about recommendations for the type of monitoring required for certain classes of security audit events.
|
||||
ms.pagetype: security
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Audit Other Privilege Use Events (Windows 10)
|
||||
description: This security policy setting is not used.
|
||||
description: Learn about the audit other privilege use events, an auditing subcategory that should not have any events in it but enables generation of event 4985(S).
|
||||
ms.assetid: 5f7f5b25-42a6-499f-8aa2-01ac79a2a63c
|
||||
ms.reviewer:
|
||||
manager: dansimp
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Basic security audit policies (Windows 10)
|
||||
description: Before you implement auditing, you must decide on an auditing policy.
|
||||
description: Learn about basic security audit policies that specify the categories of security-related events that you want to audit for the needs of your organization.
|
||||
ms.assetid: 3B678568-7AD7-4734-9BB4-53CF5E04E1D3
|
||||
ms.reviewer:
|
||||
ms.author: dansimp
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: 4608(S) Windows is starting up. (Windows 10)
|
||||
description: Describes security event 4608(S) Windows is starting up.
|
||||
description: Describes security event 4608(S) Windows is starting up. This event is logged when the LSASS.EXE process starts and the auditing subsystem is initialized.
|
||||
ms.pagetype: security
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
@ -20,7 +20,7 @@ ms.author: dansimp
|
||||
- Windows Server 2016
|
||||
|
||||
|
||||
<img src="images/event-4608.png" alt="Event 4608 illustration" width="449" height="317" hspace="10" align="left" />
|
||||
<img src="images/event-4608.png" alt="Event 4608 illustration" width="449" height="317" hspace="10" align="top" />
|
||||
|
||||
***Subcategory:*** [Audit Security State Change](audit-security-state-change.md)
|
||||
|
||||
@ -30,12 +30,13 @@ This event is logged when LSASS.EXE process starts and the auditing subsystem is
|
||||
|
||||
It typically generates during operating system startup process.
|
||||
|
||||
> **Note** For recommendations, see [Security Monitoring Recommendations](#security-monitoring-recommendations) for this event.
|
||||
> [!NOTE]
|
||||
> For recommendations, see [Security Monitoring Recommendations](#security-monitoring-recommendations) for this event.
|
||||
|
||||
<br clear="all">
|
||||
|
||||
***Event XML:***
|
||||
```
|
||||
```xml
|
||||
- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
|
||||
- <System>
|
||||
<Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-A5BA-3E3B0328C30D}" />
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: 4615(S) Invalid use of LPC port. (Windows 10)
|
||||
description: Describes security event 4615(S) Invalid use of LPC port.
|
||||
description: Describes security event 4615(S) Invalid use of LPC port. It appears that the Invalid use of LPC port event never occurs.
|
||||
ms.pagetype: security
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: 4616(S) The system time was changed. (Windows 10)
|
||||
description: Describes security event 4616(S) The system time was changed.
|
||||
description: Describes security event 4616(S) The system time was changed. This event is generated every time system time is changed.
|
||||
ms.pagetype: security
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
@ -20,7 +20,7 @@ ms.author: dansimp
|
||||
- Windows Server 2016
|
||||
|
||||
|
||||
<img src="images/event-4616.png" alt="Event 4616 illustration" width="522" height="518" hspace="10" align="left" />
|
||||
<img src="images/event-4616.png" alt="Event 4616 illustration" width="522" height="518" hspace="10" align="top" />
|
||||
|
||||
***Subcategory:*** [Audit Security State Change](audit-security-state-change.md)
|
||||
|
||||
@ -32,12 +32,13 @@ This event is always logged regardless of the "Audit Security State Change" sub-
|
||||
|
||||
You will typically see these events with “**Subject\\Security ID**” = “**LOCAL SERVICE**”, these are normal time correction actions.
|
||||
|
||||
> **Note** For recommendations, see [Security Monitoring Recommendations](#security-monitoring-recommendations) for this event.
|
||||
> [!NOTE]
|
||||
> For recommendations, see [Security Monitoring Recommendations](#security-monitoring-recommendations) for this event.
|
||||
|
||||
<br clear="all">
|
||||
|
||||
***Event XML:***
|
||||
```
|
||||
```xml
|
||||
- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
|
||||
- <System>
|
||||
<Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-A5BA-3E3B0328C30D}" />
|
||||
@ -87,7 +88,8 @@ You will typically see these events with “**Subject\\Security ID**” = “**L
|
||||
|
||||
- **Security ID** \[Type = SID\]**:** SID of account that requested the “change system time” operation. Event Viewer automatically tries to resolve SIDs and show the account name. If the SID cannot be resolved, you will see the source data in the event.
|
||||
|
||||
> **Note** A **security identifier (SID)** is a unique value of variable length used to identify a trustee (security principal). Each account has a unique SID that is issued by an authority, such as an Active Directory domain controller, and stored in a security database. Each time a user logs on, the system retrieves the SID for that user from the database and places it in the access token for that user. The system uses the SID in the access token to identify the user in all subsequent interactions with Windows security. When a SID has been used as the unique identifier for a user or group, it cannot ever be used again to identify another user or group. For more information about SIDs, see [Security identifiers](/windows/access-protection/access-control/security-identifiers).
|
||||
> [!NOTE]
|
||||
> A **security identifier (SID)** is a unique value of variable length used to identify a trustee (security principal). Each account has a unique SID that is issued by an authority, such as an Active Directory domain controller, and stored in a security database. Each time a user logs on, the system retrieves the SID for that user from the database and places it in the access token for that user. The system uses the SID in the access token to identify the user in all subsequent interactions with Windows security. When a SID has been used as the unique identifier for a user or group, it cannot ever be used again to identify another user or group. For more information about SIDs, see [Security identifiers](/windows/access-protection/access-control/security-identifiers).
|
||||
|
||||
- **Account Name** \[Type = UnicodeString\]**:** the name of the account that requested the “change system time” operation.
|
||||
|
||||
@ -161,7 +163,8 @@ You will typically see these events with “**Subject\\Security ID**” = “**L
|
||||
|
||||
For 4616(S): The system time was changed.
|
||||
|
||||
> **Important** For this event, also see [Appendix A: Security monitoring recommendations for many audit events](appendix-a-security-monitoring-recommendations-for-many-audit-events.md).
|
||||
> [!IMPORTANT]
|
||||
> For this event, also see [Appendix A: Security monitoring recommendations for many audit events](appendix-a-security-monitoring-recommendations-for-many-audit-events.md).
|
||||
|
||||
- Report all “**Subject\\Security ID**” not equals **“LOCAL SERVICE”**, which means that the time change was not made not by Windows Time service.
|
||||
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: 4625(F) An account failed to log on. (Windows 10)
|
||||
description: Describes security event 4625(F) An account failed to log on.
|
||||
description: Describes security event 4625(F) An account failed to log on. This event is generated if an account logon attempt failed for a locked out account.
|
||||
ms.pagetype: security
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
@ -20,7 +20,7 @@ ms.author: dansimp
|
||||
- Windows Server 2016
|
||||
|
||||
|
||||
<img src="images/event-4625.png" alt="Event 4625 illustration" width="449" height="780" hspace="10" align="left" />
|
||||
<img src="images/event-4625.png" alt="Event 4625 illustration" width="449" height="780" hspace="10" align="top" />
|
||||
|
||||
***Subcategories:*** [Audit Account Lockout](audit-account-lockout.md) and [Audit Logon](audit-logon.md)
|
||||
|
||||
@ -32,12 +32,13 @@ It generates on the computer where logon attempt was made, for example, if logon
|
||||
|
||||
This event generates on domain controllers, member servers, and workstations.
|
||||
|
||||
> **Note** For recommendations, see [Security Monitoring Recommendations](#security-monitoring-recommendations) for this event.
|
||||
> [!NOTE]
|
||||
> For recommendations, see [Security Monitoring Recommendations](#security-monitoring-recommendations) for this event.
|
||||
|
||||
<br clear="all">
|
||||
|
||||
***Event XML:***
|
||||
```
|
||||
```xml
|
||||
- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
|
||||
- <System>
|
||||
<Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-A5BA-3E3B0328C30D}" />
|
||||
@ -93,7 +94,8 @@ This event generates on domain controllers, member servers, and workstations.
|
||||
|
||||
- **Security ID** \[Type = SID\]**:** SID of account that reported information about logon failure. Event Viewer automatically tries to resolve SIDs and show the account name. If the SID cannot be resolved, you will see the source data in the event.
|
||||
|
||||
> **Note** A **security identifier (SID)** is a unique value of variable length used to identify a trustee (security principal). Each account has a unique SID that is issued by an authority, such as an Active Directory domain controller, and stored in a security database. Each time a user logs on, the system retrieves the SID for that user from the database and places it in the access token for that user. The system uses the SID in the access token to identify the user in all subsequent interactions with Windows security. When a SID has been used as the unique identifier for a user or group, it cannot ever be used again to identify another user or group. For more information about SIDs, see [Security identifiers](/windows/access-protection/access-control/security-identifiers).
|
||||
> [!NOTE]
|
||||
> A **security identifier (SID)** is a unique value of variable length used to identify a trustee (security principal). Each account has a unique SID that is issued by an authority, such as an Active Directory domain controller, and stored in a security database. Each time a user logs on, the system retrieves the SID for that user from the database and places it in the access token for that user. The system uses the SID in the access token to identify the user in all subsequent interactions with Windows security. When a SID has been used as the unique identifier for a user or group, it cannot ever be used again to identify another user or group. For more information about SIDs, see [Security identifiers](/windows/access-protection/access-control/security-identifiers).
|
||||
|
||||
- **Account Name** \[Type = UnicodeString\]**:** the name of the account that reported information about logon failure.
|
||||
|
||||
@ -109,27 +111,30 @@ This event generates on domain controllers, member servers, and workstations.
|
||||
|
||||
- For local user accounts, this field will contain the name of the computer or device that this account belongs to, for example: “Win81”.
|
||||
|
||||
**Logon Type** \[Type = UInt32\]**:** the type of logon which was performed. “Table 11. Windows Logon Types” contains the list of possible values for this field.
|
||||
- **Logon Type** \[Type = UInt32\]**:** the type of logon which was performed. “Table 11. Windows Logon Types” contains the list of possible values for this field.
|
||||
|
||||
| <span id="Windows_Logon_Types" class="anchor"></span>Logon Type | Logon Title | Description |
|
||||
|-----------------------------------------------------------------|-------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
|
||||
| 2 | Interactive | A user logged on to this computer. |
|
||||
| 3 | Network | A user or computer logged on to this computer from the network. |
|
||||
| 4 | Batch | Batch logon type is used by batch servers, where processes may be executing on behalf of a user without their direct intervention. |
|
||||
| 5 | Service | A service was started by the Service Control Manager. |
|
||||
| 7 | Unlock | This workstation was unlocked. |
|
||||
| 8 | NetworkCleartext | A user logged on to this computer from the network. The user's password was passed to the authentication package in its unhashed form. The built-in authentication packages all hash credentials before sending them across the network. The credentials do not traverse the network in plaintext (also called cleartext). |
|
||||
| 9 | NewCredentials | A caller cloned its current token and specified new credentials for outbound connections. The new logon session has the same local identity, but uses different credentials for other network connections. |
|
||||
| 10 | RemoteInteractive | A user logged on to this computer remotely using Terminal Services or Remote Desktop. |
|
||||
| 11 | CachedInteractive | A user logged on to this computer with network credentials that were stored locally on the computer. The domain controller was not contacted to verify the credentials. |
|
||||
|
||||
> <span id="_Ref433822321" class="anchor"></span>Table: Windows Logon Types
|
||||
<span id="_Ref433822321" class="anchor"></span>**Table 11: Windows Logon Types**
|
||||
|
||||
| <span id="Windows_Logon_Types" class="anchor"></span>Logon Type | Logon Title | Description |
|
||||
|-----------------------------------------------------------------|-------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
|
||||
| 2 | Interactive | A user logged on to this computer. |
|
||||
| 3 | Network | A user or computer logged on to this computer from the network. |
|
||||
| 4 | Batch | Batch logon type is used by batch servers, where processes may be executing on behalf of a user without their direct intervention. |
|
||||
| 5 | Service | A service was started by the Service Control Manager. |
|
||||
| 7 | Unlock | This workstation was unlocked. |
|
||||
| 8 | NetworkCleartext | A user logged on to this computer from the network. The user's password was passed to the authentication package in its unhashed form. The built-in authentication packages all hash credentials before sending them across the network. The credentials do not traverse the network in plaintext (also called cleartext). |
|
||||
| 9 | NewCredentials | A caller cloned its current token and specified new credentials for outbound connections. The new logon session has the same local identity, but uses different credentials for other network connections. |
|
||||
| 10 | RemoteInteractive | A user logged on to this computer remotely using Terminal Services or Remote Desktop. |
|
||||
| 11 | CachedInteractive | A user logged on to this computer with network credentials that were stored locally on the computer. The domain controller was not contacted to verify the credentials. |
|
||||
|
||||
|
||||
**Account For Which Logon Failed:**
|
||||
|
||||
- **Security ID** \[Type = SID\]**:** SID of the account that was specified in the logon attempt. Event Viewer automatically tries to resolve SIDs and show the account name. If the SID cannot be resolved, you will see the source data in the event.
|
||||
|
||||
> **Note** A **security identifier (SID)** is a unique value of variable length used to identify a trustee (security principal). Each account has a unique SID that is issued by an authority, such as an Active Directory domain controller, and stored in a security database. Each time a user logs on, the system retrieves the SID for that user from the database and places it in the access token for that user. The system uses the SID in the access token to identify the user in all subsequent interactions with Windows security. When a SID has been used as the unique identifier for a user or group, it cannot ever be used again to identify another user or group. For more information about SIDs, see [Security identifiers](/windows/access-protection/access-control/security-identifiers).
|
||||
> [!NOTE]
|
||||
> A **security identifier (SID)** is a unique value of variable length used to identify a trustee (security principal). Each account has a unique SID that is issued by an authority, such as an Active Directory domain controller, and stored in a security database. Each time a user logs on, the system retrieves the SID for that user from the database and places it in the access token for that user. The system uses the SID in the access token to identify the user in all subsequent interactions with Windows security. When a SID has been used as the unique identifier for a user or group, it cannot ever be used again to identify another user or group. For more information about SIDs, see [Security identifiers](/windows/access-protection/access-control/security-identifiers).
|
||||
|
||||
- **Account Name** \[Type = UnicodeString\]**:** the name of the account that was specified in the logon attempt.
|
||||
|
||||
@ -151,35 +156,36 @@ This event generates on domain controllers, member servers, and workstations.
|
||||
|
||||
- **Failure Reason** \[Type = UnicodeString\]**:** textual explanation of **Status** field value. For this event it typically has “**Account locked out**” value.
|
||||
|
||||
- **Status** \[Type = HexInt32\]**:** the reason why logon failed. For this event it typically has “**0xC0000234**” value. The most common status codes are listed in “Table 12. Windows logon status codes.”
|
||||
- **Status** \[Type = HexInt32\]**:** the reason why logon failed. For this event it typically has “**0xC0000234**” value. The most common status codes are listed in Table 12. Windows logon status codes.
|
||||
|
||||
| Status\\Sub-Status Code | Description |
|
||||
|-------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------|
|
||||
| 0XC000005E | There are currently no logon servers available to service the logon request. |
|
||||
| 0xC0000064 | User logon with misspelled or bad user account |
|
||||
| 0xC000006A | User logon with misspelled or bad password |
|
||||
| 0XC000006D | This is either due to a bad username or authentication information |
|
||||
| 0XC000006E | Unknown user name or bad password. |
|
||||
| 0xC000006F | User logon outside authorized hours |
|
||||
| 0xC0000070 | User logon from unauthorized workstation |
|
||||
| 0xC0000071 | User logon with expired password |
|
||||
| 0xC0000072 | User logon to account disabled by administrator |
|
||||
| 0XC00000DC | Indicates the Sam Server was in the wrong state to perform the desired operation. |
|
||||
| 0XC0000133 | Clocks between DC and other computer too far out of sync |
|
||||
| 0XC000015B | The user has not been granted the requested logon type (aka logon right) at this machine |
|
||||
| 0XC000018C | The logon request failed because the trust relationship between the primary domain and the trusted domain failed. |
|
||||
| 0XC0000192 | An attempt was made to logon, but the N**etlogon** service was not started. |
|
||||
| 0xC0000193 | User logon with expired account |
|
||||
| 0XC0000224 | User is required to change password at next logon |
|
||||
| 0XC0000225 | Evidently a bug in Windows and not a risk |
|
||||
| 0xC0000234 | User logon with account locked |
|
||||
| 0XC00002EE | Failure Reason: An Error occurred during Logon |
|
||||
| 0XC0000413 | Logon Failure: The machine you are logging onto is protected by an authentication firewall. The specified account is not allowed to authenticate to the machine. |
|
||||
| 0x0 | Status OK. |
|
||||
<span id="_Ref433822658" class="anchor"></span>**Table 12: Windows logon status codes.**
|
||||
|
||||
> <span id="_Ref433822658" class="anchor"></span>Table: Windows logon status codes.
|
||||
>
|
||||
> **Note** To see the meaning of other status\\sub-status codes you may also check for status code in the Window header file ntstatus.h in Windows SDK.
|
||||
| Status\\Sub-Status Code | Description |
|
||||
|-------------------------|------------------------------------------------------------------------------------------------------|
|
||||
| 0XC000005E | There are currently no logon servers available to service the logon request. |
|
||||
| 0xC0000064 | User logon with misspelled or bad user account |
|
||||
| 0xC000006A | User logon with misspelled or bad password |
|
||||
| 0XC000006D | This is either due to a bad username or authentication information |
|
||||
| 0XC000006E | Unknown user name or bad password. |
|
||||
| 0xC000006F | User logon outside authorized hours |
|
||||
| 0xC0000070 | User logon from unauthorized workstation |
|
||||
| 0xC0000071 | User logon with expired password |
|
||||
| 0xC0000072 | User logon to account disabled by administrator |
|
||||
| 0XC00000DC | Indicates the Sam Server was in the wrong state to perform the desired operation. |
|
||||
| 0XC0000133 | Clocks between DC and other computer too far out of sync |
|
||||
| 0XC000015B | The user has not been granted the requested logon type (aka logon right) at this machine |
|
||||
| 0XC000018C | The logon request failed because the trust relationship between the primary domain and the trusted domain failed. |
|
||||
| 0XC0000192 | An attempt was made to logon, but the N**etlogon** service was not started. |
|
||||
| 0xC0000193 | User logon with expired account |
|
||||
| 0XC0000224 | User is required to change password at next logon |
|
||||
| 0XC0000225 | Evidently a bug in Windows and not a risk |
|
||||
| 0xC0000234 | User logon with account locked |
|
||||
| 0XC00002EE | Failure Reason: An Error occurred during Logon |
|
||||
| 0XC0000413 | Logon Failure: The machine you are logging onto is protected by an authentication firewall. The specified account is not allowed to authenticate to the machine. |
|
||||
| 0x0 | Status OK. |
|
||||
|
||||
> [!NOTE]
|
||||
> To see the meaning of other status\\sub-status codes you may also check for status code in the Window header file ntstatus.h in Windows SDK.
|
||||
|
||||
More information: <https://dev.windows.com/en-us/downloads>
|
||||
|
||||
@ -187,7 +193,7 @@ More information: <https://dev.windows.com/en-us/downloads>
|
||||
|
||||
**Process Information:**
|
||||
|
||||
- **Caller Process ID** \[Type = Pointer\]: hexadecimal Process ID of the process that attempted the logon. Process ID (PID) is a number used by the operating system to uniquely identify an active process. To see the PID for a specific process you can, for example, use Task Manager (Details tab, PID column):
|
||||
- **Caller Process ID** \[Type = Pointer\]: hexadecimal Process ID of the process that attempted the logon. Process ID (PID) is a number used by the operating system to uniquely identify an active process. To see the PID for a specific process you can, for example, use Task Manager (Details tab, PID column):<br/><br/>
|
||||
|
||||
<img src="images/task-manager.png" alt="Task manager illustration" width="585" height="375" />
|
||||
|
||||
@ -241,7 +247,8 @@ More information: <https://dev.windows.com/en-us/downloads>
|
||||
|
||||
For 4625(F): An account failed to log on.
|
||||
|
||||
> **Important** For this event, also see [Appendix A: Security monitoring recommendations for many audit events](appendix-a-security-monitoring-recommendations-for-many-audit-events.md).
|
||||
> [!IMPORTANT]
|
||||
> For this event, also see [Appendix A: Security monitoring recommendations for many audit events](appendix-a-security-monitoring-recommendations-for-many-audit-events.md).
|
||||
|
||||
- If you have a pre-defined “**Process Name**” for the process reported in this event, monitor all events with “**Process Name**” not equal to your defined value.
|
||||
|
||||
@ -277,17 +284,17 @@ For 4625(F): An account failed to log on.
|
||||
|
||||
- Monitor for all events with the fields and values in the following table:
|
||||
|
||||
| **Field** | Value to monitor for |
|
||||
|----------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
|
||||
| **Failure Information\\Status** or <br>**Failure Information\\Sub Status** | 0XC000005E – “There are currently no logon servers available to service the logon request.” <br>This is typically not a security issue but it can be an infrastructure or availability issue. |
|
||||
| **Failure Information\\Status** or <br>**Failure Information\\Sub Status** | 0xC0000064 – “User logon with misspelled or bad user account”. <br>Especially if you get a number of these in a row, it can be a sign of user enumeration attack. |
|
||||
| **Failure Information\\Status** or <br>**Failure Information\\Sub Status** | 0xC000006A – “User logon with misspelled or bad password” for critical accounts or service accounts. <br>Especially watch for a number of such events in a row. |
|
||||
| **Failure Information\\Status** or <br>**Failure Information\\Sub Status** | 0XC000006D – “This is either due to a bad username or authentication information” for critical accounts or service accounts. <br>Especially watch for a number of such events in a row. |
|
||||
| **Failure Information\\Status** or <br>**Failure Information\\Sub Status** | 0xC000006F – “User logon outside authorized hours”. |
|
||||
| **Failure Information\\Status** or <br>**Failure Information\\Sub Status** | 0xC0000070 – “User logon from unauthorized workstation”. |
|
||||
| **Failure Information\\Status** or <br>**Failure Information\\Sub Status** | 0xC0000072 – “User logon to account disabled by administrator”. |
|
||||
| **Failure Information\\Status** or <br>**Failure Information\\Sub Status** | 0XC000015B – “The user has not been granted the requested logon type (aka logon right) at this machine”. |
|
||||
| **Failure Information\\Status** or <br>**Failure Information\\Sub Status** | 0XC0000192 – “An attempt was made to logon, but the Netlogon service was not started”. <br>This is typically not a security issue but it can be an infrastructure or availability issue. |
|
||||
| **Failure Information\\Status** or <br>**Failure Information\\Sub Status** | 0xC0000193 – “User logon with expired account”. |
|
||||
| **Failure Information\\Status** or <br>**Failure Information\\Sub Status** | 0XC0000413 – “Logon Failure: The machine you are logging onto is protected by an authentication firewall. The specified account is not allowed to authenticate to the machine”. |
|
||||
| **Field** | Value to monitor for |
|
||||
|----------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
|
||||
| **Failure Information\\Status** or <br>**Failure Information\\Sub Status** | 0XC000005E – “There are currently no logon servers available to service the logon request.” <br>This is typically not a security issue but it can be an infrastructure or availability issue. |
|
||||
| **Failure Information\\Status** or <br>**Failure Information\\Sub Status** | 0xC0000064 – “User logon with misspelled or bad user account”. <br>Especially if you get a number of these in a row, it can be a sign of user enumeration attack. |
|
||||
| **Failure Information\\Status** or <br>**Failure Information\\Sub Status** | 0xC000006A – “User logon with misspelled or bad password” for critical accounts or service accounts. <br>Especially watch for a number of such events in a row. |
|
||||
| **Failure Information\\Status** or <br>**Failure Information\\Sub Status** | 0XC000006D – “This is either due to a bad username or authentication information” for critical accounts or service accounts. <br>Especially watch for a number of such events in a row. |
|
||||
| **Failure Information\\Status** or <br>**Failure Information\\Sub Status** | 0xC000006F – “User logon outside authorized hours”. |
|
||||
| **Failure Information\\Status** or <br>**Failure Information\\Sub Status** | 0xC0000070 – “User logon from unauthorized workstation”. |
|
||||
| **Failure Information\\Status** or <br>**Failure Information\\Sub Status** | 0xC0000072 – “User logon to account disabled by administrator”. |
|
||||
| **Failure Information\\Status** or <br>**Failure Information\\Sub Status** | 0XC000015B – “The user has not been granted the requested logon type (aka logon right) at this machine”. |
|
||||
| **Failure Information\\Status** or <br>**Failure Information\\Sub Status** | 0XC0000192 – “An attempt was made to logon, but the Netlogon service was not started”. <br>This is typically not a security issue but it can be an infrastructure or availability issue. |
|
||||
| **Failure Information\\Status** or <br>**Failure Information\\Sub Status** | 0xC0000193 – “User logon with expired account”. |
|
||||
| **Failure Information\\Status** or <br>**Failure Information\\Sub Status** | 0XC0000413 – “Logon Failure: The machine you are logging onto is protected by an authentication firewall. The specified account is not allowed to authenticate to the machine”. |
|
||||
|
||||
|
||||
Reference in New Issue
Block a user