Credentials Processes in Windows Authentication

Question

Hey Microsoft community!

Please I need some explanation about a case I have in event logs I receive related to LSASS process in Windows.

In a domain-based environment, I am getting NTLM authentication events (event ID 4624) in the target machine where LogonType is 3 (Network).

After that LsaRegisterLogonProcess() was called to register the logon and authenticate the session (again in the target machine).

After the logon attempt was successful I received a lot of audit_failure events coming from the SAM service such as the one below

Then event 4648 was logged

And event 4624 with LogonType 10 (RDP)

After RDP logon, LsaRegisterLogonProcess was called again and there were no audit failure events from SAM after it this time..

I have two questions for this,

1- Why wouldn't the logon event (4624) and LsaRegisterLogonProcess be logged into the AD domain server instead.. knowing I checked the event viewer logs there and didn't find such events? Based on my knowledge that logon events and authentication of domain accounts should be logged in the AD server..

2- Why do I have a lot of Audit_failure events following to the LsaRegisterLogonProcess()?

Thanks,

Bilal.

Answer 1

Hi,

Thank you for posting your query.

Kindly follow the steps provided below to resolve your issue.

Windows credentials management is the process by which the operating system receives the credentials from the service or user and secures that information for future presentation to the authenticating target. In the case of a domain-joined computer, the authenticating target is the domain controller. The credentials used in authentication are digital documents that associate the user's identity to some form of proof of authenticity, such as a certificate, a password, or a PIN.

Go to this link for your reference and other troubleshooting procedures https://learn.microsoft.com/en-us/windows-server/security/windows-authentication/credentials-processes-in-windows-authentication

Do not hesitate to message us if you need further assistance.

If the answer is helpful kindly click "Accept as Answer" and up vote it