2

I woke up to a creepy Windows event where the Server B used the Computer account$ of Server A to log on to Server B (itself).

The logon type is 2 and the destination process is of course "lsass.exe"

Why would a computer account request an interactive logon attempt type 2 instead of over the network type 3?

The failure reason is "The user has not been granted the requested logon type at this machine."

2
  • of course. Server B attempted to use Server A's own computer account to authenticate to its own lsass.exe, BTW Server A and B are in the same VLAN with no firewall restrictions Feb 17, 2018 at 11:00
  • Do you have any scripts or services running that might trigger this?
    – Tom K.
    Feb 19, 2018 at 8:58

2 Answers 2

1

There are a couple of instances where a computer would use a type 2 logon instead of type 3:

  1. KVM over IP is viewed as a type 2 logon.
  2. Using "RunAs" without "/netonly" is a type 2 logon.
  3. Before Logon Type 10 came into existence, RDP logons were type 2 logons. How old are these machines?
0

Type 2 logon is an interactive logon that means that someone tried to logon to your computer interactively. That means with user interaction normally by submitting a user / password in a logon screen...

If logon is successfully all applications that the user executes will be executed on the user's behalf.

If the logon is not interactively is normally considered type 3 if being done from the network. More than this is hard to provide as we might need to get access to more information.

To leave you with more information on the subject please check the bellow links.

https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2003/cc787567(v=ws.10)

https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-authsod/bfc67803-2c41-4fde-8519-adace79465f6

https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-authsod/64781df1-ee20-413e-b8c5-6511c90dbc30#gt_9360639b-135c-46dc-9f9e-85728008146f

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .