topic Re: Windows authentication creates to much noise in All Apps and Add-ons

Windows authentication creates to much noise

nathanluke86 — Tue, 21 Jan 2020 10:48:38 GMT

Hello Splunkers,

Is it just me or are Windows Auth events ridiculously noisey.

I am trying to get accurate login/logout information but the events show multiple success and logoff events for the same attempt judging by time. I thought this might be duplicate logs but they all have different record ID's as below.

Is this just windows in general or might this be an issue with how our DC's (5 in total) log or are setup.

multiple successes in a row with the same time stamp are mainly for 1 dc so not just multiple dc attempts to authenticate if that makes sense.

Re: Windows authentication creates to much noise

to4kawa — Tue, 21 Jan 2020 10:57:35 GMT

I see duplicate logs,
21/01/2020 08:28:04.000 ipAddress 10.200.33.211 EventID 4624
What is the query?

Re: Windows authentication creates to much noise

gcusello — Tue, 21 Jan 2020 11:08:03 GMT

Hi @nathanluke86,
Windows generates much noise (every login usually generates between 10 and 13 login/logout events!).
You should try to group events using transform command.
I had this problem and I solved in a different way: I executed every 5 minutes on clients a script with the command "query user" that extract the connected uses and gives infos about login and logout.
This script with the inputs.conf were in a dedicated Technical Add-on.

Ciao.
Giuseppe

Re: Windows authentication creates to much noise

nathanluke86 — Tue, 21 Jan 2020 12:27:17 GMT

@to4kawa

all the logs have different record id's so are not duplicate logs.

This was my first impression but turns out they are not.

Thanks for the input, much appreciated

Re: Windows authentication creates to much noise

nathanluke86 — Tue, 21 Jan 2020 12:36:04 GMT

Hi @gcusello

Not just me then. I don't really have the permissions to run scripts on clients.

Was hoping for an indicator of a true login within the logs or a method to make the results more accurate.

We use smart cards to authenticate and ideally logging when a smart card is inserted to login or removed to log out would be ideal but struggling to get this information in the logs.

Re: Windows authentication creates to much noise

gcusello — Tue, 21 Jan 2020 12:56:10 GMT

Hi @nathanluke86,
see if your SmartCards give additional logs!
Windows isn't so clear in logins, you could use transaction command with options (maxspan=1h startswith="EventCode=4624)" endswith="EventCode=4634") but isn't so precise!

Ciao.
Giuseppe