FailedLogonDescriptionSourceAccountUnknownUser for compromised accounts

David McAllister
Occasional Contributor

Hi Guys,


I number of known compromised accounts are showing "FailedLogonDescriptionSourceAccountUnknownUser" login activity against a domain controller, see attached pic.


Can anyone explain what this means?


3 Replies

It's a bug. The system tries to find a resource string in the currently set language and failed to find it.

I opened a bug for it. 

Thanks for reporting it!



Also, I am guessing that the string that was planned behind this key is probably saying we saw a failed authentication from an unknown user.

Thanks Eli, interesting to know!


If you need anything from me with regards to this please let me know.

Related Conversations
Tabs and Dark Mode
cjc2112 in Discussions on
46 Replies
Extentions Synchronization
Deleted in Discussions on
3 Replies
Stable version of Edge insider browser
HotCakeX in Discussions on
35 Replies
How to Prevent Teams from Auto-Launch
chenrylee in Microsoft Teams on
30 Replies
flashing a white screen while open new tab
Deleted in Discussions on
14 Replies
Security Community Webinars
Valon_Kolica in Security, Privacy & Compliance on
13 Replies