How can I search for a user's Incorrect Password?

jctst714 · ‎11-07-2018

Hello,

I have a user that occasionally experiences a lack of connectivity over a VPN into one of my servers. He can connect most of the time, but there are instances where he's unable to remote in with RDP.

How can I search for the user/Active Directory (already set up in Splunk environment) to see if there are any incorrect logins? It's a simple query, but I'm new to the system.

Thank you in advance.

sduff_splunk · ‎11-07-2018

index=wineventlogs EventType=4625
You can look at the Failure_Reason field to determine why the account failed.

How can I search for a user's Incorrect Password?

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

A Four-Part Event Series: Full Stack Observability For the AI Era

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

Event Series: Level up your SOC: Advancing with Splunk Enterprise Security

Join the Conversation

How can I search for a user's Incorrect Password?

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

A Four-Part Event Series: Full Stack Observability For the AI Era

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

Event Series: Level up your SOC: Advancing with Splunk Enterprise Security