https://community.splunk.com/t5/Security/Windows-Unknown-User-Name-or-Bad-Password/m-p/289892#M7731 <P>At first, I was going to think of a complicated option, assuming an option where you have a domain environment, you could use <A href="https://splunkbase.splunk.com/app/1151/">SA-ldapsearch</A> to take the username and lookup and see if it exists in the domain. </P> <P>But a better solution is much easier. You see the Failure Status and Substatus codes? Build a lookup for those... they come out of ntstatus.h. In particular 0xC0000064 means there is no such user, and 0xC000006A means wrong password.</P> <P>Code List: <A href="https://msdn.microsoft.com/en-us/library/cc704588.aspx">https://msdn.microsoft.com/en-us/library/cc704588.aspx</A><BR /> Microsoft Windows Vista Security forum question: <A href="https://answers.microsoft.com/en-us/windows/forum/windows_vista-security/where-can-i-find-the-full-list-of-failure-reasons/d0269426-2183-4d99-8af0-cc009dee6658">https://answers.microsoft.com/en-us/windows/forum/windows_vista-security/where-can-i-find-the-full-list-of-failure-reasons/d0269426-2183-4d99-8af0-cc009dee6658</A></P> <P>You can also do some googling for event code 4625 and see what others have to say about it.</P> Sun, 07 Jan 2018 00:06:22 GMT acharlieh 2018-01-07T00:06:22Z https://community.splunk.com/t5/Security/Windows-Unknown-User-Name-or-Bad-Password/m-p/289891#M7730 <P>Hi.<BR /> How can I distinguish events with Authentication when «Unknown User Name» and when «Bad Password»?</P> <P><span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/4105iC4F18A715D81CEFF/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> <P>Ping me if you need more information <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Sat, 06 Jan 2018 15:23:31 GMT https://community.splunk.com/t5/Security/Windows-Unknown-User-Name-or-Bad-Password/m-p/289891#M7730 test_qweqwe 2018-01-06T15:23:31Z https://community.splunk.com/t5/Security/Windows-Unknown-User-Name-or-Bad-Password/m-p/289892#M7731 <P>At first, I was going to think of a complicated option, assuming an option where you have a domain environment, you could use <A href="https://splunkbase.splunk.com/app/1151/">SA-ldapsearch</A> to take the username and lookup and see if it exists in the domain. </P> <P>But a better solution is much easier. You see the Failure Status and Substatus codes? Build a lookup for those... they come out of ntstatus.h. In particular 0xC0000064 means there is no such user, and 0xC000006A means wrong password.</P> <P>Code List: <A href="https://msdn.microsoft.com/en-us/library/cc704588.aspx">https://msdn.microsoft.com/en-us/library/cc704588.aspx</A><BR /> Microsoft Windows Vista Security forum question: <A href="https://answers.microsoft.com/en-us/windows/forum/windows_vista-security/where-can-i-find-the-full-list-of-failure-reasons/d0269426-2183-4d99-8af0-cc009dee6658">https://answers.microsoft.com/en-us/windows/forum/windows_vista-security/where-can-i-find-the-full-list-of-failure-reasons/d0269426-2183-4d99-8af0-cc009dee6658</A></P> <P>You can also do some googling for event code 4625 and see what others have to say about it.</P> Sun, 07 Jan 2018 00:06:22 GMT https://community.splunk.com/t5/Security/Windows-Unknown-User-Name-or-Bad-Password/m-p/289892#M7731 acharlieh 2018-01-07T00:06:22Z