How to capture invalid login attempts?

Question

Hi team!

What would be the best way to capture, at the workstation, what is the process that triggers invalid logon attempts against our file server? Procmon.exe? Audit?

Hope I was clear enough.

Answer 1

Hi @Doria ,

I would suggest enabling audit logging on your Domain Controllers (DCs), then you may capture failed logon attempts.
How to Audit Successful Logon/Logoff and Failed Logons in Active Directory

----------

(If the reply was helpful please don't forget to upvote or accept as answer, thank you)

Best regards,
Leon

Answer 2

Thanks for your answer.

I've done this! Now I need to find out WHAT is causing that on the workstation! What would be the best approach?

Regards.

Answer 3

On time, I need to find out which command, or service, or program is causing the various attempts.

Answer 4

Try to install Process Monitor on the server and capture what's happening during Failed Login attempts. Detailed information here:
DC causing multiple Failed Login Attempt Errors
https://community.spiceworks.com/topic/2203205-dc-causing-multiple-failed-login-attempt-errors
Please note: Information posted in the given link is hosted by a third party. Microsoft does not guarantee the accuracy and effectiveness of information.

-------------------------------------------------------------------------------------

If the Answer is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 5

Hi everyone!

Well, I was finally able to find what causes, from a workstation, invalid login attempts to the file server. Using procmon and scheduling its execution through a scheduled task, I was able to discover that the logon failure occurs from a GPO that runs a batch script to map a user network drive. The strange thing is that the GPO is for the user, not the computer. Perhaps, the login attempt was made using the system account! Weird. How to understand this?