All Apps and Add-ons

EventCode 4625 LogonType 2 by Google Chrome

burakatabay
Path Finder

sourcetype="wineventlog" EventCode=4625 src=MachineX | table action, app, Caller_Process_Name, dvc, Logon_Type
my query is as above. Result is surprising. (dvc=MachineX)
Google Chrome Event 4625 and logontype 2 what does it mean ? ı dont understand ?
alt text

0 Karma
1 Solution

nickhills
Ultra Champion

Logon Type 2 is normally an 'interactive' logon, meaning that the process is trying to authenticate within a running session.

To help understand what is going on, you might want to look at the user account which is failing with 4625. If you have the windows TA available, you should be able include the fields src_user dest_user.

I have seen some browser plugins cause this in the past, and my guess is that the user in question will be SYSTEM, but see what shows up.

If my comment helps, please give it a thumbs up!

View solution in original post

burakatabay
Path Finder

I guess you are right. It could be extansion. When ı look at the logs, I see advabi.dll this dll file manage the extansion and windows api services. Sorry for my bad english. thank you

0 Karma

nickhills
Ultra Champion

Logon Type 2 is normally an 'interactive' logon, meaning that the process is trying to authenticate within a running session.

To help understand what is going on, you might want to look at the user account which is failing with 4625. If you have the windows TA available, you should be able include the fields src_user dest_user.

I have seen some browser plugins cause this in the past, and my guess is that the user in question will be SYSTEM, but see what shows up.

If my comment helps, please give it a thumbs up!
Get Updates on the Splunk Community!

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...