0

Every one hour or so I have this event in my Event viewer -> Windows logs -> Security log.

I understand the consent.exe is Windows' UAC control, what i wan't to know is why and what is trying to log into my administrator account every 30 min / every 1h.

The detail of the log is (I have a bunch of these btw.):

An account failed to log on.

Subject:
    Security ID:        SYSTEM
    Account Name:       DESKTOP-8P22P26$
    Account Domain:     WORKGROUP
    Logon ID:       0x3E7

Logon Type:         2

Account For Which Logon Failed:
    Security ID:        NULL SID
    Account Name:       Admin
    Account Domain:     DESKTOP-8P22P26

Failure Information:
    Failure Reason:     Unknown user name or bad password.
    Status:         0xC000006D
    Sub Status:     0xC000006A

Process Information:
    Caller Process ID:  0x2260
    Caller Process Name:    C:\Windows\System32\consent.exe

Network Information:
    Workstation Name:   DESKTOP-8P22P26
    Source Network Address: ::1
    Source Port:        0

Detailed Authentication Information:
    Logon Process:      CredPro
    Authentication Package: Negotiate
    Transited Services: -
    Package Name (NTLM only):   -
    Key Length:     0
  • The substatus 0xC000006A means that whatever is failing has the correct username but incorrect password. Which is weird because the account for which logon failed has a null sid which usually means bad username... – DarkMatter Mar 6 at 19:56
0

Logon Type: 2

2 means it is Interactive (logon at keyboard and screen of system)

Security ID: NULL SID

Subject is usually Null or one of the Service principals, though not that useful.

Logon Process: CredPro

CredPro indicates a logon initiated by User Account Control


With these, you can determine that someone is in fact trying to log on. At regular intervals, could be a script (maybe, at that lenght they are trying to make it seem like it's another admin or something, compared to trying to log on every 30 minutes).

See this from MSFT of what looks like a similar issue.


Also if you are watching Event Viewer, I'd also suggest centralizing the Event Logs maybe to another dashboard (useful if the account becomes compromised). See these types of modules here (I'm involved in the project) and also others that can collect EventLog events into another format like JSON.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy