Microsoft Secure Tech Accelerator
Apr 03 2024, 07:00 AM - 11:00 AM (PDT)
Microsoft Tech Community
SOLVED

FailedLogonDescriptionSourceAccountUnknownUser for compromised accounts

Copper Contributor

Hi Guys,

 

I number of known compromised accounts are showing "FailedLogonDescriptionSourceAccountUnknownUser" login activity against a domain controller, see attached pic.

 

Can anyone explain what this means?

atafailed.png

3 Replies
best response confirmed by David McAllister (Copper Contributor)
Solution

It's a bug. The system tries to find a resource string in the currently set language and failed to find it.

I opened a bug for it. 

Thanks for reporting it!

 

Eli

Also, I am guessing that the string that was planned behind this key is probably saying we saw a failed authentication from an unknown user.

Thanks Eli, interesting to know!

 

If you need anything from me with regards to this please let me know.

1 best response

Accepted Solutions
best response confirmed by David McAllister (Copper Contributor)
Solution

It's a bug. The system tries to find a resource string in the currently set language and failed to find it.

I opened a bug for it. 

Thanks for reporting it!

 

Eli

View solution in original post