Hello
According to a discussion on GitHub, Windows Server 2012 and below do not record IP and Port details for NTLM logins in Event 4625. This issue has been fixed in Windows Server 2016. Unfortunately, I couldn’t find any specific patches for Windows Server 2012 and below to address this issue.
However, you might be able to get more detailed logs by enabling certain debug flags. For example, you can use the nltest command to enable more detailed logging for the NetLogon service. Here’s how you can do it:
Open the Run dialog (Win + R), type in: nltest /dbflag:2080ffff, and press OK.
Restart the NetLogon service. The related activity may be logged to %windir%/debug/netlogon.log.
Once you’re done with the debugging, don’t forget to disable it by opening the Run dialog again, typing in: nltest /dbflag:0, and pressing OK.
Please note that these steps should be performed by an IT professional or under their guidance, as they involve changes that could affect your system’s operation.