Security Compliance

Event information for Windows failed logons

This article addresses an issue that prevents Microsoft Remote Desktop Protocol logon failures from generating an expected 4625 event. The issue logs a 4771 event (UserAuthTicketFailure).

First published date

10/30/2018 7:42 PM

Last published date

3/8/2022 5:59 PM

Overview

This article applies to Security Event Manager (formerly Log & Event Manager).
Microsoft® Remote Desktop Protocol (RDP) logon failures do not generate a 4625 event as expected. Instead, a 4771 event (UserAuthTicketFailure) event is logged.

Product section

Security Event Manager

Resolution

When you track logon failures, not all logon failures are captured with a 4625 event. This event only captures logon failures to local machines or local accounts.

Using RDP 

  • Using RDP to connect as .\administrator or another local account will authenticate against the local machine and create a 4625 event.

Using a domain account 

  • Using a domain account interactively (logging in through a virtual console or directly logging in to the machine) creates a 4625 event.
  • When using a domain account and RDP, a 4771 event is logged because the account is checked against the domain controller. The account is not authenticated against the local machine or the cached credentials on the local machine.
  • Because Kerberos is used for this process, a 4771 event is logged for a pre-authentication failure. This event logs the source machine and source account of the logon failure, but does not contain information for the destination machine. This is a limitation for the generated event information.
  • Changing the audit policy or troubleshooting the issue will not yield the intended destination of the logon attempt because it is terminated at the domain controller.

Disclaimer: Please note, any content posted herein is provided as a suggestion or recommendation to you for your internal use. This is not part of the SolarWinds software or documentation that you purchased from SolarWinds, and the information set forth herein may come from third parties. Your organization should internally review and assess to what extent, if any, such custom scripts or recommendations will be incorporated into your environment.  You elect to use third party content at your own risk, and you will be solely responsible for the incorporation of the same, if any.