Why is Windows event 4627 tagged as MachineLogonFailure in LEM?

From what I've read online, it's a normal event that returns Group Membership Information. It appears in the logs between events 4624 (An account was successfully logged on) and 4634 (An account was logged off). By being tagged as MachineLogonFailure, if I filter on that event there are tons of results that don't appear to indicate a failed logon.

Find more posts tagged with

Accepted answers

All comments

curtisi

That looks like the case looking at the connector Regex. Any ID between 4625 and 4633 (inclusive) will be categorized a MachineLogonFailure. That should be a case to Support to get the connector fixed. Can you attach an EVTX from Event Viewer of an example event?

papringle

Curtis,

Please find attached an example evtx of that event id. Do I need to open a case, or is that something you'll handle on your end?

Thank you!

Paul

Sample 4627.evtx

curtisi

I have a ticket into dev, and have attached the EVTX file. If you open a Support ticket, that way they have contact information to reach out to you directly and not via THWACK. It's in our tracking system as LEM-3543.

curtisi

Hey Paul, I checked that EVTX and there's nothing in it. Can you re-run the export and confirm it contains some events?

papringle

Sorry about that. I should have checked to make sure there was something in there before I sent it. This one does have a sample of the event in question.

Sample 4627.evtx