Explanation on multiple failed Event ID - 4625 with different logon types (2 & 11) for a single logon attempt

Shady 0 Reputation points
2023-01-17T04:45:14.95+00:00

Hi all, I am encountering a problem that I cannot seem to find the answer for. I have a user that attempted a remote desktop logon to another server and failed the login with a wrong password. He only attempted this action once. However, on windows event logs, there were 3 log entries with event ID 4625 (failed login) generated for this particular 1 attempt. Each of these log entries have different logon types (2 & 11). I cannot figure out why 3 log entries were generated for 1 failed attempt. Any help is appreciated. Thank you!

Windows Server
Windows Server
A family of Microsoft server operating systems that support enterprise-level management, data storage, applications, and communications.
12,127 questions
Windows Server Security
Windows Server Security
Windows Server: A family of Microsoft server operating systems that support enterprise-level management, data storage, applications, and communications.Security: The precautions taken to guard against crime, attack, sabotage, espionage, or another threat.
1,721 questions
0 comments No comments
{count} votes