• State Not Answered
  • Locked Locked
  • Replies 4 replies
  • Subscribers 21 subscribers
  • Views 1412 views
  • Users 0 members are here
Options
Related
This discussion has been locked. The information referenced herein may be inaccurate due to age, software updates, or external references.
You can no longer post new replies to this discussion. If you have a similar question you can start a new discussion in this forum.

Windows failed logins tracking

FormerMember
FormerMember

Hi folks,

We currently have v9.5 running on a Windows 2012 R2 VM which is the loghost for our environment of approx. 60 systems. We use AD for authentication and I'm attempting to configure the logger to alert on multiple failed logins, however, nothing appears to be getting to the loghost from the DC, other than the previously configured items. I have been able to configure this successfully for our Linux VM's but no luck on the Windows side. My assumption is, the problem is between the keyboard and monitor emoticons_happy.png

I've configured the Event Log Forwarder to send all things Microsoft Security to the loghost but having no luck. Has anyone done this successfully? What have I missed?

Thanks in advance.

Buddy

  • 0

    Buddy

    What version of the Log Forwarder are you using?

  • 0

    How are you determining that nothing is reaching the syslog server?

    If you have not already done so, create a new rule with a filter that includes either the event IDs or message text snippet(or both) that you want to capture.  Then add an action to display to a  specific display ID( 02 for example).

    Are you using a Win2008 or Win2012 AD server? If so make sure you are looking for the 'new' event ID(4625).

    If your filter is working you will see the events in that console view.

  • FormerMember
    0 FormerMember in reply to bkyle

    Looks like 1.2.0.114.

  • FormerMember
    0 FormerMember in reply to kstone

    I'm using the test feature on the Log Forwarder. I see all of the other configured log entries reaching the server but not the Windows failed login entries.

    I've created the new filter using the text snippet and an email alert, no luck, though.

    The domain controllers are operating @ 2012 R2, I'll modify the filter to look for 4625.

    Thanks for the advice, much appreciated.

SolarWinds solutions are rooted in our deep connection to our user base in the THWACK® online community. More than 195,000 members are here to solve problems, share technology and best practices, and directly contribute to our product development process.

SolarWinds Customer Success Center Certification Media Vault Link Accounts
About THWACK Blogs For Government Edit Settings Free Tools & Trials
Legal Documents Terms of Use Privacy California Privacy Rights Security Information
©2024 SolarWinds Worldwide, LLC. All Rights Reserved.