User Logon Failed
User Logon Failed search terms have the prefix “User Logon Failed - “, e.g., “User Logon Failed - Auth Type - Password”
|
Field |
Description |
|---|---|
|
Auth Type - Password |
Indicates password authentication |
|
Auth type - Pubkey |
Indicates key based authentication |
|
Login Type - Login Via SSH |
Indicates that a user logged in via ssh |
|
Login Type - Windows Login Batch |
Indicates windows batch login (Type 4, eg schtasks) |
|
Login Type - Windows Login Cached |
Indicates logon via cached credentials (Type 11, CachedIntetractive) |
|
Login Type - Windows Login Interactive |
Indicates interactive logon (Type 2, eg RDP) |
|
Login Type - Windows Network Cleartext |
Indicates logon via ssh (Type 8) |
|
Login Type - Windows Network |
Indicates network login (Type 3, eg Psexec) |
|
Login Type - Windows Login New Credential |
Indicates the usage of new credentials (Type 9, eg Runas command) |
|
Login Type - Windows Login Remote Interactive |
Indicates remote logon (Type 10, eg RDP) |
|
Login Type - Windows Login Service |
Indicates that a service was started by SCM (Type 5) |
|
Login Type - Windows Login Unlock |
Indicates that the workstation was unlocked (Type 7) |
|
Source IP |
The source IP from which the login event was generated |
|
Source Port |
The source port from which the login event was generated |
|
Username |
Username associated with the log in event |