How to get logon failure message(4625) on the... Expand / Collapse
Author
Message
Posted 7/6/2010 8:02:44 AM
Forum Newbie

Forum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum Newbie

Group: Forum Members
Last Login: 7/6/2010 9:51:07 AM
Posts: 1, Visits: 4
As per my knowledge, when a logon activity is performed in the client machine with wrong password,
* "Pre-authentication" message id 4771 is added in the DC
* "Logon failure" message id 4625 is added in the client machine where the wrong password is used for login

In my application, there is a requirement to track the message-id 4625 in client corresponding to the message-id 4771 in DC. That is I will provide the message 4771 as the input to the function, I have to retrieve the message 4625 as the output.

How can I implement it?. Is there any linkage between the 4771 message generated in the DC with the 4625 message generated in the client?.

Thanks in advance.
Post #402
Posted 7/7/2010 2:33:08 PM
Expert

ExpertExpertExpertExpertExpertExpertExpertExpert

Group: Administrators
Last Login: 4/20/2009 7:57:33 AM
Posts: 329, Visits: 0
You are right about which events are logged where but there is no solid way to correlate them. 
Post #404
Posted 10/2/2018 8:43:38 AM
Forum Newbie

Forum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum Newbie

Group: Forum Members
Last Login: 10/2/2018 8:38:18 AM
Posts: 1, Visits: 0
correlate on the event time from host -> DC
Post #8513
« Prev Topic | Next Topic »


Permissions Expand / Collapse

All times are GMT -5:00, Time now is 8:35am