1

I am quite new to analyzing the windows logs. I have been seeing excessive logons with 4624 and 4625 with the Subject/account name: DomainController(actual name of the domaincontroller is different) to user accounts.

I understand that it makes sense to have logons requests from user machine to the Domain controller. But why there would be excessive logon requests from domain controllers to user accounts that too with misspelled usernames and passwords as Failure reason and the process name as lsass.exe?

Improve this question
3
  • Seeing one of the actual log entries would help, with identifying information like server and domain name obscured. But if it's a small number of usernames attempted repeatedly, a common cause might be that someone wrote a script or set up a scheduled task with incorrect credentials and it's banging its head against the wall. A very large number of usernames attempted once or twice each, on the other hand, might indicate a password guessing attack.
    – gowenfawr
    Commented Aug 23, 2018 at 2:12
  • Hey thanks for your reply. If it is a password guessing attack, would that mean the Domain controllers are hacked and they are requesting logons to user accounts? And just to make it clear: the only process name i see is lsass.exe
    – iAMsecgeek
    Commented Aug 24, 2018 at 18:47
  • It is more likely that another system would be attempting logins against the Domain Controllers; the contents of the "Network Information" section for Event IDs 4624/4625 should list Workstation Name and/or Source Network Address and Source Port of the actual origination.
    – gowenfawr
    Commented Aug 24, 2018 at 18:52

1 Answer 1

Reset to default
0

There are a lot of things it could be. For example, someone may have typed their username wrong in their WiFi settings on their cell phone, causing their phone to try to authenticate over and over again erroneously. There are too many other possibilities without knowing every dynamic of your environment.

Improve this answer
1
  • Also worth noting, the behavior you are describing can happen if the user typed their password wrong on iOS mail and didn't bother fixing it because Apple Mail will keep trying every 15 or so minutes (fetch interval) regardless of the error returned.
    – Allison
    Commented Oct 22, 2018 at 4:49

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .