myt*_*lon 13 security audit windows-event-log windows-sbs-2011 windows-server-2012-r2
在 3 个独立的系统中，域控制器服务器上多次记录以下事件（每天 30 到 4,000 次，具体取决于系统）：
An account failed to log on.
Subject:
Security ID: SYSTEM
Account Name: %domainControllerHostname%$
Account Domain: %NetBIOSDomainName%
Logon ID: 0x3E7
Logon Type: 3
Account For Which Logon Failed:
Security ID: NULL SID
Account Name:
Account Domain:
Failure Information:
Failure Reason: Unknown user name or bad password.
Status: 0xc000006d
Sub Status: 0xc0000064
Process Information:
Caller Process ID: 0x1ec
Caller Process Name: C:\Windows\System32\lsass.exe
Network Information:
Workstation Name: %domainControllerHostname%
Source Network Address: -
Source Port: -
Detailed Authentication Information:
Logon Process: Schannel
Authentication Package: Kerberos
Transited Services: -
Package Name (NTLM only): -
Key Length: 0
This event is generated when a logon request fails. It is generated on the computer where access was attempted.
The Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.
The Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).
The Process Information fields indicate which account and process on the system requested the logon.
The Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.
The authentication information fields provide detailed information about this specific logon request.
- Transited services indicate which intermediate services have participated in this logon request.
- Package name indicates which sub-protocol was used among the NTLM protocols.
- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
此事件与我在研究期间发现的所有其他事件略有不同，但我已确定以下内容：
Event ID: 4625. “帐户登录失败”。Logon Type: 3. “网络（即从网络上的其他地方连接到这台计算机上的共享文件夹）”。Security ID: NULL SID. “未识别有效帐户”。Sub Status: 0xC0000064. “用户名不存在”。Caller Process Name: C:\Windows\System32\lsass.exe. 本地安全机构子系统服务 (LSASS) 是 Microsoft Windows 操作系统中的一个进程，负责在系统上实施安全策略。它验证登录到 Windows 计算机或服务器的用户、处理密码更改并创建访问令牌。它还会写入 Windows 安全日志。Workstation Name: SERVERNAME. 身份验证请求由域控制器本身提交或通过域控制器提交。受影响系统的相似之处：
受影响系统的差异：
我在受影响最严重的系统中注意到了一些有趣的事情：
以下事件记录在终端/远程桌面服务服务器上，但次数远不及：
An account failed to log on.
Subject:
Security ID: NULL SID
Account Name: -
Account Domain: -
Logon ID: 0x0
Logon Type: 3
Account For Which Logon Failed:
Security ID: NULL SID
Account Name: %terminalServerHostname%
Account Domain: %NetBIOSDomainName%
Failure Information:
Failure Reason: Unknown user name or bad password.
Status: 0xC000006D
Sub Status: 0xC0000064
Process Information:
Caller Process ID: 0x0
Caller Process Name: -
Network Information:
Workstation Name: %terminalServerHostname%
Source Network Address: %terminalServerIPv6Address%
Source Port: %randomHighNumber%
Detailed Authentication Information:
Logon Process: NtLmSsp
Authentication Package: NTLM
Transited Services: -
Package Name (NTLM only): -
Key Length: 0
This event is generated when a logon request fails. It is generated on the computer where access was attempted.
The Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.
The Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).
The Process Information fields indicate which account and process on the system requested the logon.
The Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.
The authentication information fields provide detailed information about this specific logon request.
- Transited services indicate which intermediate services have participated in this logon request.
- Package name indicates which sub-protocol was used among the NTLM protocols.
- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
因此，总而言之，它似乎肯定与使用员工用户帐户从台式计算机访问网络有关，但我看不出是如何进行的。
2015/08/25 08:48 更新：
在受影响最严重的系统中，我已执行以下操作来隔离问题，并在每次恢复更改后执行以下操作：
WseComputerBackupSvc，WseEmailSvc，WseHealthSvc，WseMediaSvc，WseMgmtSvc，和WseNtfSvc）和通用登录失败并没有继续下去。WseMgmtSvc) 并且通用失败登录没有继续。我已经仔细检查了 Windows Server Essentials 管理服务 ( WseMgmtSvc) 是否对这些通用登录失败负责.
2015/10/08 09:06 更新：
在 2015/10/07 在 16:42 我发现了以下计划任务：
这个时间范围几乎与上面的行为完全匹配，所以我禁用了它以查看它是否会影响问题。
在 2015/10/08 的 08:57，我发现这些通用失败登录中只有 47 次被记录下来，因为它不定期地记录。
所以，我进一步缩小了范围。
小智 7
此事件通常是由陈旧的隐藏凭证引起的。从给出错误的系统中尝试此操作：
从命令提示符运行： psexec -i -s -d cmd.exe
从新的 cmd 窗口运行： rundll32 keymgr.dll,KRShowKeyMgr
删除出现在存储的用户名和密码列表中的任何项目。重新启动计算机。
| 归档时间： |
|
| 查看次数： |
125855 次 |
| 最近记录： |