DFIRHub

Windows event log ยท Security6273 Network Policy Server denied access to a user

  • Security
  • 6 fields
  • Security.evtx
  • Microsoft-Windows-Security-Auditing

Fields EvtxECmd extracts

6 columns in the EvtxECmd CSV

  • RemoteHost%ipAddress%
    • %ipAddress% = /Event/EventData/Data[@Name="CallingStationID"]
  • UserName%domain%\%user% (%sid%)
    • %domain% = /Event/EventData/Data[@Name="SubjectDomainName"]
    • %user% = /Event/EventData/Data[@Name="SubjectUserName"]
    • %sid% = /Event/EventData/Data[@Name="SubjectUserSid"]
  • PayloadData1%clientname% (%clientipaddress%)
    • %clientname% = /Event/EventData/Data[@Name="ClientName"]
    • %clientipaddress% = /Event/EventData/Data[@Name="ClientIPAddress"]
  • PayloadData2Policy name: %ProxyPolicyName%
    • %ProxyPolicyName% = /Event/EventData/Data[@Name="ProxyPolicyName"]
  • PayloadData3Auth Server: %AuthenticationServer%
    • %AuthenticationServer% = /Event/EventData/Data[@Name="AuthenticationServer"]
  • PayloadData4%FailureReason%
    • %FailureReason% = /Event/EventData/Data[@Name="Reason"]

Sample event

Event XML from the map file

<Event>
  <System>
    <Provider Name="Microsoft-Windows-Security-Auditing" Guid="54849625-5478-4994-a5ba-3e3b0328c30d"/>
    <EventID>6273</EventID>
    <Version>2</Version>
    <Level>0</Level>
    <Task>12552</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8010000000000000</Keywords>
    <TimeCreated SystemTime="XXXX 07:22:15.3559155"/>
    <EventRecordID>18469434</EventRecordID>
    <Correlation ActivityID="d2996340-cd6a-0001-4a63-99d26acdd901"/>
    <Execution ProcessID="592" ThreadID="3984"/>
    <Channel>Security</Channel>
    <Computer>XXXXXX</Computer>
    <Security/>
  </System>
  <EventData>
    <Data Name="SubjectUserSid">S-1-0-0</Data>
    <Data Name="SubjectUserName">username</Data>
    <Data Name="SubjectDomainName">domain</Data>
    <Data Name="FullyQualifiedSubjectUserName">fqdn</Data>
    <Data Name="SubjectMachineSID">S-1-0-0</Data>
    <Data Name="SubjectMachineName">-</Data>
    <Data Name="FullyQualifiedSubjectMachineName">-</Data>
    <Data Name="CalledStationID">internalip</Data>
    <Data Name="CallingStationID">remoteip</Data>
    <Data Name="NASIPv4Address">internalip</Data>
    <Data Name="NASIPv6Address">-</Data>
    <Data Name="NASIdentifier">-</Data>
    <Data Name="NASPortType">Virtual</Data>
    <Data Name="NASPort">109666304</Data>
    <Data Name="ClientName">XXX</Data>
    <Data Name="ClientIPAddress">internalip</Data>
    <Data Name="ProxyPolicyName">Use Windows authentication for all users</Data>
    <Data Name="NetworkPolicyName">-</Data>
    <Data Name="AuthenticationProvider">Windows</Data>
    <Data Name="AuthenticationServer">XXXXXXXXXXXX</Data>
    <Data Name="AuthenticationType">PAP</Data>
    <Data Name="EAPType">-</Data>
    <Data Name="AccountSessionIdentifier">-</Data>
    <Data Name="ReasonCode">16</Data>
    <Data Name="Reason">Authentication failed due to a user credentials mismatch. Either the user name provided does not map to an existing user account or the password was incorrect.</Data>
    <Data Name="LoggingResult">Accounting information was written to the local log file.</Data>
  </EventData>
</Event>

References

1 link

Source: evtx/Maps/Security_Microsoft-Windows-Security-Auditing_6273.map(opens in new tab) by Phill Moore and contributors(opens in new tab), MIT License(opens in new tab)