Yes. Yes I have seen this event. Expand / Collapse
Author
Message
Posted 1/25/2017 2:08:29 PM
Forum Newbie

Forum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum Newbie

Group: Forum Members
Last Login: 1/25/2017 5:01:13 PM
Posts: 1, Visits: 2
One of our domain controllers gave several of these events in a row all of the sudden. Names have been changed to protect the innocent:

An account was mapped for logon.

Authentication Package: Schannel
Account UPN: ACCOUNT@Domain.com
Mapped Name: ACCOUNT


With escaped characters: "An account was mapped for logon.\r\rAuthentication Package:\tSchannel\rAccount UPN:\tACCOUNT@Domain.com\rMapped Name:\tACCOUNT"

It should be noted this is an AUDIT_FAILURE, severity ERROR. Task name was "Credential Validation". These events corresponded with audit failure events 6273 (Network Policy Server denied access) and 4771 (Kerberos pre-auth failed) for the same account.
Post #7313
« Prev Topic | Next Topic »


Permissions Expand / Collapse

All times are GMT -5:00, Time now is 3:47pm