Windows event log ยท Security4775 An account could not be mapped for logon
Per Microsoft, currently this event doesn't generate ever.
- Security
- 1 field
Security.evtxMicrosoft-Windows-Security-Auditing
Notes
- Per Microsoft, currently this event doesn't generate ever.
- This map is in place in case this event does come across in logs so the Map Description field will be populated.
Fields EvtxECmd extracts
1 column in the EvtxECmd CSV
- PayloadData1
Target: %TargetUserName%- %TargetUserName% = /Event/EventData/Data[@Name="TargetUserName"]
References
3 links
- ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=4775(opens in new tab)
- docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4775(opens in new tab)
- github.com/nasbench/EVTX-ETW-Resources/blob/main/ETWProvidersCSVs/Internal/Microsoft-Windows-Security-Auditing.csv(opens in new tab)
Source: evtx/Maps/Security_Microsoft-Windows-Security-Auditing_4775.map(opens in new tab) by Andrew Rathbun and contributors(opens in new tab), MIT License(opens in new tab)