0

We have recently identified numerous login attempts from an internal machine to the active directory domain controller. The attempts are directed at the domain administrator account.

As an initial response, we checked to see whether there was some malware on the host machine that was initiating these attempts, but a scan from our AV did not return any results. Soon after this we checked the list of programs installed on the machine and everything was as per standard rollout on a user machine. Also to verify whether or not there was an automated tool, I changed the IP of the machine an re-connected it to the network by logging in to the domain and logging out of the domain, keeping it connected to the network. In both instances, the only traffic observed was a single IPC$ connection to the Active Directory DC. There were no login attempts.

How can I detect what caused the multiple login attempts?

  • 1
    Presumably you've noticed these login attempts by looking at the security event viewer for the DC? If that's the case posting a sanitized log (remove any identifying remarks) would assist us in steering you in the correct direction. – DKNUCKLES Jul 19 '16 at 13:26
  • Check the PC log as well. If the machine attempt to log into the server, it will leave trace inside windows log. – mootmoot Jul 19 '16 at 13:44
  • Are these Kerberos Pre-auth failures (4771) or actual login attempt failures (4776)? Also, in the actual alerts you'll see a hex code that explains the failure. Then look it up here: ultimatewindowssecurity.com/securitylog/encyclopedia/… OR here: ultimatewindowssecurity.com/securitylog/encyclopedia/… – HashHazard Jul 19 '16 at 13:46
1

Migrated comment to an answer as it should steer you down the correct path.

First Determine Failure Type

  • Are these Kerberos Pre-auth failures (Event ID: 4771)

OR

  • Actual login attempt failures (Event ID: 4776)?

Then ID the Specific Failure Reason

  • View the alert and ID the hex code that explains the failure.

Then look it up here:

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.