I have 100 clients that are joined to a domain. One of them is trying to do brute-force attack to the other clients. How can I get login failure logs on domain server about attacker logins?
I already enabled all audit policy settings that are related to the logins and I can see all the logs about login success/failure to the domain server but in this scenario I can not see any logs for client to client login failure.
I have a script that can help if you are on Windows Server:
function get-logonhistory{
Param (
#get ip(127.0.0.1) and number of days you want get
[string]$Computer = (Read-Host IP remoto do PC),
[int]$Days = (Read-Host number of days)
)
cls
$Result = @()
Write-Host "wait..."
$ELogs = Get-EventLog System -Source Microsoft-Windows-WinLogon -After (Get-Date).AddDays(-$Days) -ComputerName $Computer
If ($ELogs)
{ Write-Host "processing..."
ForEach ($Log in $ELogs)
{ If ($Log.InstanceId -eq 7001)
{ $ET = "Logon"
}
ElseIf ($Log.InstanceId -eq 7002)
{ $ET = "Logoff"
}
Else
{ Continue
}
$Result += New-Object PSObject -Property @{
Time = $Log.TimeWritten
'Event Type' = $ET
User = (New-Object System.Security.Principal.SecurityIdentifier $Log.ReplacementStrings[1]).Translate([System.Security.Principal.NTAccount])
}
}
$Result | Select Time,"Event Type",User | Sort Time -Descending | Out-GridView
Write-Host "Done."
}
Else
{ Write-Host "Problem with ip $Computer."
}
}
#function call
get-logonhistory
Write-Host "Press any key ..."
#stop script to window dont close
$x = $host.UI.RawUI.ReadKey("NoEcho,IncludeKeyDown")
