AD_Logon_Failed_Locked_Account

ID: 100170

Description:

A user’s logon attempt failed on an account that was subsequently locked or was already locked out.

Windows EventID 4625 indicates a failed login. There is a sub-status (0xC0000234) that can indicate the reason for the failed login.

Notes: Status - 0xc0000234 and 0xC0000234 (Capital ‘C’)

Ref: https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4625

Repository: Fluency Group: AD Type: event

Default Status:

Enabled

Selector:

Query:

Filters:

Behavior Rule:

Risks:

Attributes:

Correlation Rules:

First Occurrence:

Aggregation:

History:

This page was automatically created/formatted on Wed, 2022 May 4 21:43:53 EDT, from rule_dump.json (4d88bffdfb1cea26b3985f2193033606)