I have 100 clients that are joined to a domain. One of them is trying to do brute-force attack to the other clients. How can I get login failure logs on domain server about attacker logins?

I already enabled all audit policy settings that are related to the logins and I can see all the logs about login success/failure to the domain server but in this scenario I can not see any logs for client to client login failure.

  • AD does not log failures if they are for local accounts (like local admin or guest). Are you looking for these local account failures or for domain account failures on the clients?
    – schroeder
    May 8, 2017 at 11:46
  • Would enabling logon failures on local machines (via a GPO) and pushing logs to a centralized server (via nxlog for instance) be a solution?
    – WoJ
    May 8, 2017 at 16:35
  • I am looking for domain account failure.client A and client B joined to AD Domin and client A is attacking client B. I want to see these logs on my AD. May 8, 2017 at 17:06

1 Answer 1


I have a script that can help if you are on Windows Server:

function get-logonhistory{
Param (
 #get ip( and number of days you want get
 [string]$Computer = (Read-Host IP remoto do PC),
 [int]$Days = (Read-Host number of days)
 $Result = @()
 Write-Host "wait..."
 $ELogs = Get-EventLog System -Source Microsoft-Windows-WinLogon -After (Get-Date).AddDays(-$Days) -ComputerName $Computer
 If ($ELogs)
 { Write-Host "processing..."
 ForEach ($Log in $ELogs)
 { If ($Log.InstanceId -eq 7001)
   { $ET = "Logon"
   ElseIf ($Log.InstanceId -eq 7002)
   { $ET = "Logoff"
   { Continue
   $Result += New-Object PSObject -Property @{
    Time = $Log.TimeWritten
    'Event Type' = $ET
    User = (New-Object System.Security.Principal.SecurityIdentifier $Log.ReplacementStrings[1]).Translate([System.Security.Principal.NTAccount])
 $Result | Select Time,"Event Type",User | Sort Time -Descending | Out-GridView
 Write-Host "Done."
 { Write-Host "Problem with ip $Computer."
#function call

Write-Host "Press any key ..."
#stop script to window dont close 
$x = $host.UI.RawUI.ReadKey("NoEcho,IncludeKeyDown")
  • summarising the code would be helpful - this only grabs logs from a single computer, right?
    – schroeder
    May 8, 2017 at 11:40
  • yes , by IP ...
    – R.O.O.T
    May 8, 2017 at 11:41
  • so the OP needs to run this for every IP in his network, periodically?
    – schroeder
    May 8, 2017 at 11:42
  • your answer is not somethings that I am looking for. I need specific audit policy that is need to adjust to get this communication logs. May 8, 2017 at 11:45
  • only on windows server where the doimain is , i m not sure but i think the domain server have logs from clients , i cant test right now sorry . ali tavakoli you can test it and see if works
    – R.O.O.T
    May 8, 2017 at 11:46

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .