Not seeing any failed logons in event viewer

Question

Hello Experts, I think I can use a hand getting out Windows AD audit logging in order. For some reason I am not seeing any event ID 529/wrong password/failed logon events in our logs. I checked all three of our domain controllers. I also tested a bad password attempt with my domain user account and cannot find it in the DC's windows security logs anywhere. In active directory users and computers, it does show the time of 10:10 in the badPasswordTime attribute for my account. I do see an event 4740 for my account getting locked out in the DC event logs. As far as group policy, we have account management success/fail enabled, logon events success/fail enabled and account logon events success/fail enabled. Under advanced audit policy, we have most of those relevant audit polices enabled as well for both success/failure.

Any idea what I may be missing here?

Answer 1

You may need to configure the auditing.
https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/basic-audit-logon-events

--please don't forget to upvote and Accept as answer if the reply is helpful--

Answer 2

Hi Patrick, thanks for the link. We have these policies enabled and I can see for example event ID 4625 and some users failing to login so I think that is part of my problem. I was not searching for the correct event ID so thank you for that info. However I still cannot find my bad password event at 10:10 am eastern. I also just tried another bad password logging into Windows 10 on a different computer and cannot find that attempt at 10:52am either. It's like I'm not seeing everything.

Answer 3

Event ID 4625 is generated on the computer where access was attempted. If a domain account then you should see an authentication failure event such as 4771 or 4776 on your domain controller.

--please don't forget to upvote and Accept as answer if the reply is helpful--

Answer 4

Hi @Justin Vaughn

If you have multiple domain controllers this might explain why you are not seeing the event entry. Check the event log on the PDC, as all password failures are confirmed on the pdc. Have a look at this article which explains how to troubleshoot account lockout and will searches the event log automatically to find the failed logon events
https://nettools.net/troubleshoot-account-lockouts/

Gary.

Answer 5

Thanks for the suggestions, I have been querying the logs in our PDC and I think I am getting closer. I can now see events 4776 and 4740 but the trouble is that they all say the caller computer name is empty/null. There is no record. For event 4776s it says "source workstation" and then there is nothing.