2. How to Use Auditing to Troubleshoot Authentication
Problems
By default, Windows 7 does not add an event to the event log
when a user provides incorrect credentials (such as when a user
mistypes a password). Therefore, when troubleshooting authentication
problems, your first step should be to enable auditing for logon events so that you can gather more information
about the credentials the user provided and the resource being
accessed.
Windows 7 (and earlier versions of Windows) provides two
separate authentication auditing policies:
-
Audit Logon
Events This policy audits authentication attempts for
local resources, such as a user logging on locally, elevating
privileges using a UAC prompt, or connecting over the network
(including connecting using Remote Desktop or connecting to a
shared folder). All authentication attempts will be audited,
regardless of whether the authentication attempt uses a domain
account or a local user account.
-
Audit Account Logon
Events This policy audits domain authentications. No
matter which computer the user authenticates to, these events
appear only on the domain controller that handled the
authentication request. Typically, you do not need to enable
auditing of account logon events when
troubleshooting authentication issues on computers running
Windows 7. However, successful auditing of these events is
enabled for domain controllers by default.
To log failed authentication attempts, you must enable
auditing by following these steps:
-
Click Start and then click Control Panel. Click System And
Security. Click Administrative Tools, and then double-click
Local Security Policy.
-
In the Local Security Policy console, expand Local
Policies, and then select Audit Policy.
-
In the right pane, double-click Audit Logon Events.
-
In the Audit Logon Events Properties dialog box, select
the Failure check box to add an event to the Security event log
each time a user provides invalid credentials. If you also want
to log successful authentication attempts (which include
authentication attempts from services and other nonuser
entities), select the Success check box.
-
Click OK.
-
Restart your computer to apply the changes.
With auditing enabled, you can view audit events in Event
Viewer by following these steps:
-
Click Start, right-click Computer, and then click
Manage.
-
Expand System Tools, Event Viewer, Windows Logs, and then
select Security.
Event Viewer displays all security events. To view only
successful logons, click the Filter Current Log link in the
Actions pane and show only Event ID 4624. To view only
unsuccessful logon attempts, click the Filter Current Log link
and show only Event ID 4625.
Figure 3
shows an example of a logon audit failure that occurred when the
user provided invalid credentials at a UAC prompt. Notice that the
Caller Process Name (listed under Process Information) is
Consent.exe, the UAC process.
Audits from failed authentication attempts from across the network
resemble the following code. In particular, the Account Name,
Account Domain, Workstation Name, and Source Network Address are
useful for identifying the origin computer.
An account failed to log on.
Subject:
Security ID: NULL SID
Account Name: -
Account Domain: -
Logon ID: 0x0
Logon Type: 3
Account For Which Logon Failed:
Security ID: NULL SID
Account Name: baduser
Account Domain: NWTRADERS
Failure Information:
Failure Reason: Unknown user name or bad password.
Status: 0xc000006d
Sub Status: 0xc0000064
Process Information:
Caller Process ID: 0x0
Caller Process Name: -
Network Information:
Workstation Name: CONTOSO-DC
Source Network Address: 192.168.1.212
Source Port: 4953
Detailed Authentication Information:
Logon Process: NtLmSsp
Authentication Package: NTLM
Transited Services: -
Package Name (NTLM only): -
Key Length: 0
When you are authenticating to network resources,
authentication failures are always logged on the server, not on the
client. For example, if you attempt to connect to a shared folder
and you mistype the password, the event won't appear in your local
event log—it appears instead in the event log of the computer
sharing the folder.
Note
DON'T TRUST THE REPORTED COMPUTER
NAME
The computer sending the
authentication attempt communicates its own workstation name.
Therefore, if the attack is malicious, the workstation name might
be intentionally invalid. The Internet Protocol (IP) address
should always be correct, however.
