Local Filter - Domain Admin Login/Authentication Failures

mbaker_wv

Hello,

I am looking at creating this filter for domain admin login/authentication failures. 

the filter uses the failedauthentication.destinationaccount which points to my directory service group for builtin domain admins. it also uses the userlogonfailure.destinationaccount which also points to the same builtin domain admins directory service group.

When I try to test this filter, I RDP to a domain connected server and try to login as my domain admin account. I use the right username but purposely try the password wrong. I would expect that my filter would see this and alert me but its not. 

is there something im missing?

mbaker_wv

npatterson

You must make sure the GPO for audit login if set for logging. 

Check if your security event log shows the event 

Next check if the user defines group is set up for domain admins for this the active directory configuration is required to pick the groups.

if just filter you can filter by directory service group only rules do this so you would have to make a user defined group to filter in live stream if that helps.