Skip to main content

Excessive Logon Attempts

Purpose​

The solution monitors the domain controller for excessive logon failures within one hour, indicating a possible brute force attack. It summarizes failed logon attempts (Event ID 4625) from the Windows Security event log within a specified time window on a given machine and based on it, if it meets the criteria then it creates a ticket.

It simply checks the computer for security event log event ID 4625 where the count of occurrences is greater than 10 in the last 60 minutes. This is default setting and can be changed using the Threshold and Minutes parameters.

Associated Content​

NameTypeFunction
Automation - Excessive Logon AttemptsAutomationDetects and summarizes failed logon attempts (Event ID 4625) from the Windows Security event log within a specified time window.
Condition - Excessive Logon AttemptsConditionsThe condition runs the automation once per hour and generates a ticket with the script’s results if any monitored event log is detected.
CW Manage - Ticket Template - Excessive Logon AttemptsCW Manage Ticket TemplateThis ticket template is used to manage the CW Manage ticket generation settings for the Excessive Logon Attempts Alert Condition

Implementation​

Troubleshooting​

General Troubleshooting Steps:​

1. Identify the Account Type:

  • Domain Account: Check in Active Directory Users and Computers (ADUC).

  • Local Account: Use Computer Management > Local Users and Groups.

  • Service Account: Check services or scheduled tasks using the account.

  • Unknown Account: Investigate for potential brute-force or enumeration attacks.

2. Review Event Logs:

  • Look for Event ID 4625 in the Security log.

3. Pay attention to:

  • Status/SubStatus codes

  • Logon Type

  • Source IP/Workstation

  • Target Account Name

4. Error Code Specific Troubleshooting:​

Error CodeMeaningAction Steps
0xC000006ABad password
  1. Check if the password was recently changed.
  2. Reset the password if needed.
  3. Investigate repeated attempts (possible brute-force or excessive logon attempts).
0xC000006DBad username or auth info
  1. Verify username.
  2. Check for typos or outdated credentials.
  3. Investigate source of repeated failures.
0xC0000064Bad or misspelled username
  1. Confirm the account exists.
  2. Investigate for enumeration attempts.
0xC000005ENo logon servers available
  1. Check domain controller availability.
  2. Ensure network connectivity.
  3. Restart Netlogon service.
0xC000006FLogon outside authorized hours
  1. Review account restrictions in AD.
  2. Adjust allowed logon hours if needed.
0xC0000070Unauthorized workstation
  1. Check workstation restrictions in AD.
  2. Update allowed workstations.
0xC0000072Account disabled
  1. Enable the account in AD.
  2. Investigate why it was disabled.
0xC000015BLogon type not granted
  1. Check Group Policy or Local Security Policy.
  2. Grant appropriate logon rights.
0xC0000192Netlogon service not started
  1. Start the Netlogon service.
  2. Set it to automatic.
0xC0000193Expired account
  1. Extend or renew the account expiration date.
0xC0000413Auth firewall restriction
  1. Review firewall or security policies.
  2. Allow the account to authenticate.

5. Service Account Specific Checks:​

  • Find Services Using the Account.

  • Run: Get-WmiObject win32_service | Where-Object { $_.StartName -like "*accountname*" }
    Or check manually in Services.msc.

6. Update Password:

  • Change the password in AD.

  • Update it in all services, scheduled tasks, and applications using it.

7. If the Account is Unknown or Suspicious​

  • Investigate Source IP: Use firewall logs or SIEM tools.
  • Check for Patterns: Repeated failures from the same IP or targeting multiple accounts.
  • Block IP or Account: If malicious, take immediate action.
  • Enable Account Lockout Policies: To prevent brute-force attacks or excessive logon attempts.