0

I am quite new to analyzing the windows logs. I have been seeing excessive logons with 4624 and 4625 with the Subject/account name: DomainController(actual name of the domaincontroller is different) to user accounts.

I understand that it makes sense to have logons requests from user machine to the Domain controller. But why there would be excessive logon requests from domain controllers to user accounts that too with misspelled usernames and passwords as Failure reason and the process name as lsass.exe?

  • Seeing one of the actual log entries would help, with identifying information like server and domain name obscured. But if it's a small number of usernames attempted repeatedly, a common cause might be that someone wrote a script or set up a scheduled task with incorrect credentials and it's banging its head against the wall. A very large number of usernames attempted once or twice each, on the other hand, might indicate a password guessing attack. – gowenfawr Aug 23 '18 at 2:12
  • Hey thanks for your reply. If it is a password guessing attack, would that mean the Domain controllers are hacked and they are requesting logons to user accounts? And just to make it clear: the only process name i see is lsass.exe – iAMsecgeek Aug 24 '18 at 18:47
  • It is more likely that another system would be attempting logins against the Domain Controllers; the contents of the "Network Information" section for Event IDs 4624/4625 should list Workstation Name and/or Source Network Address and Source Port of the actual origination. – gowenfawr Aug 24 '18 at 18:52
0

There are a lot of things it could be. For example, someone may have typed their username wrong in their WiFi settings on their cell phone, causing their phone to try to authenticate over and over again erroneously. There are too many other possibilities without knowing every dynamic of your environment.

  • Also worth noting, the behavior you are describing can happen if the user typed their password wrong on iOS mail and didn't bother fixing it because Apple Mail will keep trying every 15 or so minutes (fetch interval) regardless of the error returned. – Sirens Oct 22 '18 at 4:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.