https://community.splunk.com/t5/Security/How-can-I-search-for-a-user-s-Incorrect-Password/m-p/379490#M9334 <P>Hello, </P> <P>I have a user that occasionally experiences a lack of connectivity over a VPN into one of my servers. He can connect most of the time, but there are instances where he's unable to remote in with RDP. </P> <P>How can I search for the user/Active Directory (already set up in Splunk environment) to see if there are any incorrect logins? It's a simple query, but I'm new to the system.</P> <P>Thank you in advance. </P> Thu, 08 Nov 2018 00:09:20 GMT jctst714 2018-11-08T00:09:20Z https://community.splunk.com/t5/Security/How-can-I-search-for-a-user-s-Incorrect-Password/m-p/379490#M9334 <P>Hello, </P> <P>I have a user that occasionally experiences a lack of connectivity over a VPN into one of my servers. He can connect most of the time, but there are instances where he's unable to remote in with RDP. </P> <P>How can I search for the user/Active Directory (already set up in Splunk environment) to see if there are any incorrect logins? It's a simple query, but I'm new to the system.</P> <P>Thank you in advance. </P> Thu, 08 Nov 2018 00:09:20 GMT https://community.splunk.com/t5/Security/How-can-I-search-for-a-user-s-Incorrect-Password/m-p/379490#M9334 jctst714 2018-11-08T00:09:20Z https://community.splunk.com/t5/Security/How-can-I-search-for-a-user-s-Incorrect-Password/m-p/379491#M9335 <P><CODE>index=wineventlogs EventType=4625</CODE><BR /> You can look at the <CODE>Failure_Reason</CODE> field to determine why the account failed.</P> Thu, 08 Nov 2018 01:46:54 GMT https://community.splunk.com/t5/Security/How-can-I-search-for-a-user-s-Incorrect-Password/m-p/379491#M9335 sduff_splunk 2018-11-08T01:46:54Z