Forum Discussion
RDP authentication failures not reflected in security log?
This is actually by design.
You see, when you attempt to logon to an RDP session, the security provider behind the logon process called CredSSP decides whether to employ Kerberos or NTLM to verify your identity to the remote computer.
If Kerberos is available for which you need direct line of sight towards the Domain Controller, CredSSP attempts to verify your credential with the Domain Controller. If the password provided is wrong, the Domain Controller logs an Event ID 4771 - Kerberos PreAuthentication Failed.
If Kerberos is not avaialble, CredSSP falls back to NTLM and attempts to verify your credential directly with the remote computer which in turn relays the credential verification to the Domain Controller. If, in this case, the password provided is wrong, the remote computer logs an Event ID 4625 - Logon Failed and the Domain Controller logs an Event ID 4776 - Credential Validation Failed.
Cheers,
Vojtech
For Server 2019 and 2022, I'm seeing the relevant "Logon type = 10" (the type for Terminal Server logins) entries being logged in the Security event log under event 4624.
You may just be checking for the wrong event ID, or perhaps you need to run a resultant set of policy check (gpresult /h) to confirm there are no group policies (domain or local) overriding any manually-specified local settings.
Cheers,
Lain
Thanks for responding! Oddly, these events are also not being reported. However, I discovered that if I use my surface (which is not joined to the domain) and access the server with invalid credentials, then it all works. They wound up being reported under event id 4776 in the security log.
I did run gpresult /h ... to check group policy and nothing stood out to me.
What makes me wonder is are the failed login events not reporting for in-domain computers? or is it that I am a domain admin logged into my workstation so that when I fail to log in to the domain controller it doesn't report those? Seems worrisome from a security perspective to me, but who knows?
Thanks again for your help on this!
Cory