2

I woke up to a creepy Windows event where the Server B used the Computer account$ of Server A to log on to Server B (itself).

The logon type is 2 and the destination process is of course "lsass.exe"

Why would a computer account request an interactive logon attempt type 2 instead of over the network type 3?

The failure reason is "The user has not been granted the requested logon type at this machine."

bumped to the homepage by Community yesterday

This question has answers that may be good or bad; the system has marked it active so that they can be reviewed.

  • of course. Server B attempted to use Server A's own computer account to authenticate to its own lsass.exe, BTW Server A and B are in the same VLAN with no firewall restrictions – Limpid.Security Feb 17 '18 at 11:00
  • Do you have any scripts or services running that might trigger this? – Tom K. Feb 19 '18 at 8:58
0

Type 2 logon is an interactive logon that means that someone tried to logon to your computer interactively. That means with user interaction normally by submitting a user / password in a logon screen...

If logon is successfully all applications that the user executes will be executed on the user's behalf.

If the logon is not interactively is normally considered type 3 if being done from the network. More than this is hard to provide as we might need to get access to more information.

To leave you with more information on the subject please check the bellow links.

https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2003/cc787567(v=ws.10)

https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-authsod/bfc67803-2c41-4fde-8519-adace79465f6

https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-authsod/64781df1-ee20-413e-b8c5-6511c90dbc30#gt_9360639b-135c-46dc-9f9e-85728008146f

0

There are a couple of instances where a computer would use a type 2 logon instead of type 3:

  1. KVM over IP is viewed as a type 2 logon.
  2. Using "RunAs" without "/netonly" is a type 2 logon.
  3. Before Logon Type 10 came into existence, RDP logons were type 2 logons. How old are these machines?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.