Windows Logon Failure Investigation

The following Event ID's indicate that a logon failed:

• Event ID 529 : Unknown user name or bad password
• Event ID 530 : Logon time restriction violation
• Event ID 531 : Account disabled
• Event ID 532 : Account expired
• Event ID 533 : Workstation restriction - not allowed to logon at this computer
• Event ID 534 : Inadequate rights - as in user account attempting console login to server
• Event ID 535 : Password expired
• Event ID 536 : NetLogon service down
• Event ID 537 : unexpected error - the who knows ??? factor
• Event ID 539 : Logon Failure: Account locked out
• Event ID 627 : NT AUTHORITY\ANONYMOUS is trying to change a password
• Event ID 644 : User account Locked out

Event ID 529 will also have a process ID that can be used to find the program that passed on the logon attempt. Use the Task Manager (ctrl+alt+delete then select Task Manager, or if logged in remotely, Start / Windows Security) to lookup the name of the process, from the "Processes" tab, select View / Select Columns and check "PID (Process Identifier)" then click ok.

With Event ID 529, Logon Type 3, and a PID that turns out to be inetinfo.exe, the error was probably caused by an attempt to log in to the server via the remote web workspace, Outlook web access, etc... The web access log may have more information including the IP address of the attacker.

With Event ID 529, Logon Type 3, and a PID that turns out to be advapi it was(apparently) an attempt to log in via SMTP and relay email^. The SMTP service can be set to log detailed events, which will include the IP address of the attacker. +

See also:

  .