Home / server / Questions / 772787
Accepted
parsecpython
Asked: 2016-04-26 07:58:49 +0800 CST

How do you get detailed information on Active Directory logon failures?

  • 772

In my domain controller event log, I'm getting an account failure from a username of a service account.
The info is:

Security ID: DOMAIN\serviceaccount
Account Name: serviceaccount
Additional Information: 

Caller Computer Name: FreeRDP

This is really no help to me at all. I'm looking for an IP address, since any client can just 'tell' me who they are when they try to login. Is there any verbose or text based logging that I can check or implement to get source/destination IP, etc?

active-directory windows-event-log

1 Answers

  1. Best Answer

    The security event log does not provide every conceivable piece of information. If you need more details, install and use SysMon:

    https://technet.microsoft.com/en-us/sysinternals/sysmon

    Network logging is not enabled by default, you would need to include the -n switch. 

    sysmon -accepteula –i –h sha1,sha256 –n
    • 0