All Apps and Add-ons

EventCode 4625 LogonType 2 by Google Chrome

burakatabay
Path Finder

sourcetype="wineventlog" EventCode=4625 src=MachineX | table action, app, Caller_Process_Name, dvc, Logon_Type
my query is as above. Result is surprising. (dvc=MachineX)
Google Chrome Event 4625 and logontype 2 what does it mean ? ı dont understand ?
alt text

0 Karma
1 Solution

nickhills
Ultra Champion

Logon Type 2 is normally an 'interactive' logon, meaning that the process is trying to authenticate within a running session.

To help understand what is going on, you might want to look at the user account which is failing with 4625. If you have the windows TA available, you should be able include the fields src_user dest_user.

I have seen some browser plugins cause this in the past, and my guess is that the user in question will be SYSTEM, but see what shows up.

If my comment helps, please give it a thumbs up!

View solution in original post

burakatabay
Path Finder

I guess you are right. It could be extansion. When ı look at the logs, I see advabi.dll this dll file manage the extansion and windows api services. Sorry for my bad english. thank you

0 Karma

nickhills
Ultra Champion

Logon Type 2 is normally an 'interactive' logon, meaning that the process is trying to authenticate within a running session.

To help understand what is going on, you might want to look at the user account which is failing with 4625. If you have the windows TA available, you should be able include the fields src_user dest_user.

I have seen some browser plugins cause this in the past, and my guess is that the user in question will be SYSTEM, but see what shows up.

If my comment helps, please give it a thumbs up!
Get Updates on the Splunk Community!

Don't wait! Accept the Mission Possible: Splunk Adoption Challenge Now and Win ...

Attention everyone! We have exciting news to share! We are recruiting new members for the Mission Possible: ...

Unify Your SecOps with Splunk Mission Control

In today’s post, I'm excited to share some recent Splunk Mission Control innovations. With Splunk Mission ...

Data Preparation Made Easy: SPL2 for Edge Processor

By now, you may have heard the exciting news that Edge Processor, the easy-to-use Splunk data preparation tool ...