No event 4625 generated on failed login

Question

I have a weird situation, I set up a RD Gateway. When doing some self testing brute forcing logins almost no event 4625 get logged on the gateway. I tried a password about 30 times and I only got two 4625 events.

I do see on the DC the failed logons, and lockouts do occur, just event 4625 don't get logged on the gateway.

What could be causing this weird behavior?

Answer 1

Hi,
Thank you for posting your query. Here is an official link you may refer to.

4625(F): An account failed to log on.
https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4625

---If the suggestions above are helpful, please ACCEPT ANSWER. Really appreciate. This will also help others with similar issue to find this post quickly. ---

Answer 2

Thanks, but my question is why are these events NOT being logged on failed logons?

I did notice something interesting, if I try logging in with a wrong user name, event 4625 does get generated per attempt, but if I use a correct user name 99% I don't get an event 4625, I write 99% because as I was testing yesterday I did manage to somehow trigger two event 4625's with correct user names.

Any advise would be appreciated.

Answer 3

Nothing?! no one else noticed this behavior?