Event Log messages for failed logon attempts

Discussion:

Sean Warnock

2003-10-25 14:59:11 UTC

I am currently working on a small script that will parse the
event logs of a Windows NT/2000/2003 domain controller looking for
failed logon attempts. I am currently aware of event log message 529.
I believe that I have been able to generate several other error messages
for failed logon attempts depending upon what a client is using to
authenticate with (ex. Kerberos, NTLM, etc...). Does anyone have any
other input or articles that they would suggest as the only KB article
that I have found so far was 299475.

Sean

---------------------------------------------------------------------------
FREE Whitepaper: Better Management for Network Security

Looking for a better way to manage your IP security?
Learn how Solsoft can help you:
- Ensure robust IP security through policy-based management
- Make firewall, VPN, and NAT rules interoperable across heterogeneous
networks
- Quickly respond to network events from a central console

Download our FREE whitepaper at:
http://www.securityfocus.com/sponsor/Solsoft_focus-ms_031015
---------------------------------------------------------------------------

Drew Hunt

2003-10-27 17:31:31 UTC

Permalink

This is a little better since it gives you logon types.
http://www.microsoft.com/technet/treeview/default.asp?url=/technet/prodt
echnol/windowsserver2003/proddocs/standard/518.asp

Or http://tinyurl.com/p4ve

There is quite a lot of info out there on failed logons. What I would
like to know is when someone locks their machine. That doesn't seem to
trigger anything in the event logs. But I don't want to audit every
object access. Any ideas?

Drew

-----Original Message-----
From: Sean Warnock [mailto:***@warnocksolutions.com]
Sent: Saturday, October 25, 2003 7:59 AM
To: FOCUS-***@SECURITYFOCUS.COM
Subject: Event Log messages for failed logon attempts

I am currently working on a small script that will parse the
event logs of a Windows NT/2000/2003 domain controller looking for
failed logon attempts. I am currently aware of event log message 529. I
believe that I have been able to generate several other error messages
for failed logon attempts depending upon what a client is using to
authenticate with (ex. Kerberos, NTLM, etc...). Does anyone have any
other input or articles that they would suggest as the only KB article
that I have found so far was 299475.

Sean

---------------------------------------------------------------------------
Network with over 10,000 of the brightest minds in information security
at the largest, most highly-anticipated industry event of the year.
Don't miss RSA Conference 2004! Choose from over 200 class sessions and
see demos from more than 250 industry vendors. If your job touches
security, you need to be here. Learn more or register at
http://www.securityfocus.com/sponsor/RSA_focus-ms_031027
and use priority code SF4.
---------------------------------------------------------------------------

Erick Kinnee

2003-10-31 01:03:26 UTC

Permalink

http://www.microsoft.com/technet/treeview/default.asp?url=/technet/prodtechnol/windowsserver2003/proddocs/standard/518.asp
http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/bestprac/bpent/sec3/monito.asp

These might help, I refer to them quite often.

Post by Sean Warnock
I am currently working on a small script that will parse the
event logs of a Windows NT/2000/2003 domain controller looking for
failed logon attempts. I am currently aware of event log message 529.
I believe that I have been able to generate several other error messages
for failed logon attempts depending upon what a client is using to
authenticate with (ex. Kerberos, NTLM, etc...). Does anyone have any
other input or articles that they would suggest as the only KB article
that I have found so far was 299475.
Sean
---------------------------------------------------------------------------
FREE Whitepaper: Better Management for Network Security
Looking for a better way to manage your IP security?
- Ensure robust IP security through policy-based management
- Make firewall, VPN, and NAT rules interoperable across heterogeneous
networks
- Quickly respond to network events from a central console
http://www.securityfocus.com/sponsor/Solsoft_focus-ms_031015
---------------------------------------------------------------------------

--
Erick Kinnee
City of Fort Worth, Texas
IT Solutions / Network Security
Desk: 817.392.6839
Cell: 817.929.0995

Brad Judy

2003-11-04 18:11:31 UTC

Permalink

It sounds like you're trying to write something like this:
http://pantheon.yale.edu/~kjh27/logger.html

The author may be willing to distribute it beyond other EDUs if you ask.

Brad Judy

Information Technology Services
University of Colorado at Boulder

Post by Drew Hunt
-----Original Message-----
Sent: Saturday, October 25, 2003 8:59 AM
Subject: Event Log messages for failed logon attempts
I am currently working on a small script that will
parse the event logs of a Windows NT/2000/2003 domain
controller looking for failed logon attempts. I am currently
aware of event log message 529.
I believe that I have been able to generate several other
error messages for failed logon attempts depending upon what
a client is using to authenticate with (ex. Kerberos, NTLM,
etc...). Does anyone have any other input or articles that
they would suggest as the only KB article that I have found
so far was 299475.
Sean
--------------------------------------------------------------
-------------
FREE Whitepaper: Better Management for Network Security
Looking for a better way to manage your IP security?
- Ensure robust IP security through policy-based management
- Make firewall, VPN, and NAT rules interoperable across
heterogeneous networks
- Quickly respond to network events from a central console
http://www.securityfocus.com/sponsor/Solsoft_focus-ms_031015
--------------------------------------------------------------
-------------

Ken Hoover

2003-11-04 21:17:42 UTC

Permalink

Hi Sean-

I'm the author of the script that Brad is referring to. Logger does
exactly what you're looking for and a lot more.

There's a download link on the web page if you want to give it a try.

I used to only give it out to other educational institutions but I've
dropped that restriction so feel free to have at it.

Please e-mail me with bug reports, suggestions, etc.

- Ken Hoover

Post by Brad Judy
http://pantheon.yale.edu/~kjh27/logger.html
The author may be willing to distribute it beyond other EDUs if you ask.
Brad Judy
Information Technology Services
University of Colorado at Boulder

--
Kenneth J. Hoover <***@yale.edu>
Systems Programmer
Yale University ITS AM&T

---------------------------------------------------------------------------
Network with over 10,000 of the brightest minds in information security
at the largest, most highly-anticipated industry event of the year.
Don't miss RSA Conference 2004! Choose from over 200 class sessions and
see demos from more than 250 industry vendors. If your job touches
security, you need to be here. Learn more or register at
http://www.securityfocus.com/sponsor/RSA_focus-ms_031027
and use priority code SF4.
---------------------------------------------------------------------------

Rob McShinsky

2003-11-05 15:08:35 UTC

Permalink

Have you looked at the resource kit utility EVENTCOMB. It has this
functionality as a built in scan. The only difference would be to give it
some extra criteria to look for NTLM or Kerberos in the event text. The info
can be output to CSV, TXT, an Access DB or SQL Server. I believe the
current version is version 9.0.

Rob McShinsky

----- Original Message -----
From: "Brad Judy" <***@colorado.edu>
To: "'Sean Warnock'" <***@warnocksolutions.com>;
<FOCUS-***@securityfocus.com>
Sent: Tuesday, November 04, 2003 1:11 PM
Subject: RE: Event Log messages for failed logon attempts

--------------------------------------------------------------------------

Post by Brad Judy
Network with over 10,000 of the brightest minds in information security
at the largest, most highly-anticipated industry event of the year.
Don't miss RSA Conference 2004! Choose from over 200 class sessions and
see demos from more than 250 industry vendors. If your job touches
security, you need to be here. Learn more or register at
http://www.securityfocus.com/sponsor/RSA_focus-ms_031027
and use priority code SF4.
--------------------------------------------------------------------------

-
---------------------------------------------------------------------------
Network with over 10,000 of the brightest minds in information security
at the largest, most highly-anticipated industry event of the year.
Don't miss RSA Conference 2004! Choose from over 200 class sessions and
see demos from more than 250 industry vendors. If your job touches
security, you need to be here. Learn more or register at
http://www.securityfocus.com/sponsor/RSA_focus-ms_031027
and use priority code SF4.
---------------------------------------------------------------------------

Salmon, Daniel J.

2003-11-04 21:05:09 UTC

Permalink

There is a tool in the 2003 resource kit tools called eventcombmt.exe.
Here is the description of the tool:

Event Comb (EventCombMT) is a GUI tool that searches event logs on
multiple DCs/Servers and collects EventID records matching the specified
criteria.

The 2003 resource kit tools can be found here:
http://www.microsoft.com/windowsserver2003/techinfo/reskit/resourcekit.m
spx

It has worked well for me.

Dan

-----Original Message-----
From: Brad Judy [mailto:***@colorado.edu]
Sent: Tuesday, November 04, 2003 12:12 PM
To: 'Sean Warnock'; FOCUS-***@securityfocus.com
Subject: RE: Event Log messages for failed logon attempts

It sounds like you're trying to write something like this:
http://pantheon.yale.edu/~kjh27/logger.html

The author may be willing to distribute it beyond other EDUs if you ask.

Brad Judy

Information Technology Services
University of Colorado at Boulder

------------------------------------------------------------------------
---
Network with over 10,000 of the brightest minds in information security
at the largest, most highly-anticipated industry event of the year.
Don't miss RSA Conference 2004! Choose from over 200 class sessions and
see demos from more than 250 industry vendors. If your job touches
security, you need to be here. Learn more or register at
http://www.securityfocus.com/sponsor/RSA_focus-ms_031027
and use priority code SF4.
------------------------------------------------------------------------
---

---------------------------------------------------------------------------
Network with over 10,000 of the brightest minds in information security
at the largest, most highly-anticipated industry event of the year.
Don't miss RSA Conference 2004! Choose from over 200 class sessions and
see demos from more than 250 industry vendors. If your job touches
security, you need to be here. Learn more or register at
http://www.securityfocus.com/sponsor/RSA_focus-ms_031027
and use priority code SF4.
---------------------------------------------------------------------------

Free, Bob

2003-11-06 21:32:48 UTC

Permalink

Post by Salmon, Daniel J.
There is a tool in the 2003 resource kit tools called eventcombmt.exe.

Athought it's also in the RK, Eventcomb is part of the Account Lockout
and Management Tools package that has some additional tools and
extension dll's that are quite useful and not in the RK.

http://www.microsoft.com/downloads/details.aspx?FamilyId=7AF2E69C-91F3-4
E63-8629-B999ADDE0B9E&displaylang=en

Post by Salmon, Daniel J.

Post by Sean Warnock
I am currently aware of event log message 529.
I believe that I have been able to generate several other error
messages for failed logon attempts depending upon what a client is
using to authenticate with (ex. Kerberos, NTLM, etc...). Does anyone
have any other input or articles that they would suggest

Account Passwords and Policies whitepaper has over 30 Logon Event Ids
described and also shows how to utilize netlogon trace files if you want
to dig deeper.[Analyzing Log File Information section]

http://www.microsoft.com/technet/treeview/default.asp?url=/technet/prodt
echnol/windowsserver2003/maintain/operate/BPACTLCK.asp

hth

Bob Free
Sr Network Specialist
PG&E Co

---------------------------------------------------------------------------
Network with over 10,000 of the brightest minds in information security
at the largest, most highly-anticipated industry event of the year.
Don't miss RSA Conference 2004! Choose from over 200 class sessions and
see demos from more than 250 industry vendors. If your job touches
security, you need to be here. Learn more or register at
http://www.securityfocus.com/sponsor/RSA_focus-ms_031027
and use priority code SF4.
---------------------------------------------------------------------------