deepblue/windows-itpro-docs
1
0
Fork 0
mirror of https://github.com/MicrosoftDocs/windows-itpro-docs.git synced 2025-05-13 05:47:23 +00:00
Code Issues Actions 2 Packages Projects Releases Wiki Activity

conflict resolved

Browse Source
This commit is contained in:
Asha Iyengar 2021-09-18 16:37:27 +05:30 committed by GitHub
parent babcc6903b
commit f91a0d978b
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
windows/security/threat-protection/auditing/event-4776.md
View File

@ -145,5 +145,5 @@ For 4776(S, F): The computer attempted to validate the credentials for an accoun
| **User logon outside authorized hours** | Can indicate a compromised account; especially relevant for highly critical accounts. | | **User logon outside authorized hours** | Can indicate a compromised account; especially relevant for highly critical accounts. |
| **User logon from unauthorized workstation** | Can indicate a compromised account; especially relevant for highly critical accounts. | | **User logon from unauthorized workstation** | Can indicate a compromised account; especially relevant for highly critical accounts. |
| **User logon to account disabled by administrator** | For example, N events in last N minutes can be an indicator of an account compromise attempt, especially relevant for highly critical accounts. | | **User logon to account disabled by administrator** | For example, N events in last N minutes can be an indicator of an account compromise attempt, especially relevant for highly critical accounts. |
| **User logon with expired account** | Can indicate an account compromise attempt; especially relevant for highly critical accounts. | | **User logon with expired account** | Can indicate an account compromise attempt; especially relevant for highly critical accounts. |
| **User logon with account locked** | Can indicate a brute-force password attack; especially relevant for highly critical accounts. | | **User logon with account locked** | Can indicate a brute-force password attack; especially relevant for highly critical accounts. |