How can I search for a user's Incorrect Password?

jctst714 · ‎11-07-2018

Hello,

I have a user that occasionally experiences a lack of connectivity over a VPN into one of my servers. He can connect most of the time, but there are instances where he's unable to remote in with RDP.

How can I search for the user/Active Directory (already set up in Splunk environment) to see if there are any incorrect logins? It's a simple query, but I'm new to the system.

Thank you in advance.

sduff_splunk · ‎11-07-2018

index=wineventlogs EventType=4625
You can look at the Failure_Reason field to determine why the account failed.

How can I search for a user's Incorrect Password?

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

ATTENTION: We’re Moving! (AGAIN!)

Deep Dive: Optimizing Telemetry Pipelines in Splunk Observability Cloud

Announcing Modern Navigation: A New Era of Splunk User Experience

Join the Conversation

How can I search for a user's Incorrect Password?

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

ATTENTION: We’re Moving! (AGAIN!)

Deep Dive: Optimizing Telemetry Pipelines in Splunk Observability Cloud

Announcing Modern Navigation: A New Era of Splunk User Experience