Announcement

Collapse
No announcement yet.

Help me analyze Audit log

Collapse
X
  • Filter
  • Time
  • Show
Clear All
new posts

  • Help me analyze Audit log

    I enabled auditing in my AD as a test I tried the account logon : succcess /Failure.

    When I analyzing the log especially on the failure I cannot understand some.. Is there any table or explanation about the codes..

    Like I catched this log on failure
    service name: krbtgt/mydomain
    Pre-authetication type: 0x2
    Failure code : 0x18

    How can you explain this.. I found so many from same account same IP and usind administrator account, I'm I having an DOS attack?
    Learning something new always

  • #2
    event IDs

    a good source for event ID errors is www.eventid.net sometimes som erros in IDS can overlap with others.
    Beauty is in the eyes of the beholder

    Comment

    Working...
    X