Notification

Icon
Error

Need help finishing a report for Failed Logons - Need help finishing a report for Failed Logons

Posted: Tuesday, October 20, 2020 3:10:33 PM(UTC)
Helpdesk15

Helpdesk15

Member Original PosterPosts: 1
0
Like
The report I have works great (I got it from here)!! However, I would like it to show only findings with "Unknown user name or bad password." as the reason.
Any help is VERY much appreciated!
-Jason

Select Top 1000000 tblAssets.AssetID,
tblAssets.AssetName,
SubString(tblNtlogMessage.Message, CharIndex('Account Name:',
tblNtlogMessage.Message, CharIndex('Account Domain', tblNtlogMessage.Message))
+ 14, CharIndex('Account Domain:', tblNtlogMessage.Message,
CharIndex('Logon Type:', tblNtlogMessage.Message)) -
CharIndex('Account Name:', tblNtlogMessage.Message,
CharIndex('Account Domain', tblNtlogMessage.Message)) - 14) As Account,
SubString(tblNtlogMessage.Message, CharIndex('Account Domain:',
tblNtlogMessage.Message, CharIndex('Logon Type:', tblNtlogMessage.Message)) +
16, CharIndex('Failure Information:', tblNtlogMessage.Message) -
CharIndex('Account Domain:', tblNtlogMessage.Message, CharIndex('Logon Type:',
tblNtlogMessage.Message)) - 16) As 'Account Domain',
SubString(tblNtlogMessage.Message, CharIndex('Failure Reason:',
tblNtlogMessage.Message) + 16, CharIndex('Status', tblNtlogMessage.Message) -
CharIndex('Failure Reason:', tblNtlogMessage.Message) - 16) As Reason,
tblNtlog.TimeGenerated
From tblAssets
Inner Join tblAssetCustom On tblAssets.AssetID = tblAssetCustom.AssetID
Inner Join tblNtlog On tblAssets.AssetID = tblNtlog.AssetID
Inner Join tblNtlogMessage On tblNtlogMessage.MessageID = tblNtlog.MessageID
Inner Join tblNtlogSource On tblNtlogSource.SourcenameID =
tblNtlog.SourcenameID
Where tblNtlog.Eventcode = 4625 And tblAssetCustom.State = 1
Order By tblNtlog.TimeGenerated Desc

Active Discussions

Lansweeper SSH - Keyboard Interactive Authentication
by  blackmoonwolf   Go to last post Go to first unread
Last post: Today at 5:12:41 AM(UTC)
Lansweeper Get My Documents Folder Size
by  cbraafhart  
Go to last post Go to first unread
Last post: Yesterday at 2:25:18 PM(UTC)
Lansweeper Lansweeper Errors - Licencing and scanning
by  dnkleaf   Go to last post Go to first unread
Last post: 11/27/2020 1:02:13 PM(UTC)
Lansweeper Search for Blank Fields
by  CS Caritas Socialis IT  
Go to last post Go to first unread
Last post: 11/27/2020 12:19:05 PM(UTC)
Lansweeper Uninstalled software still listed
by  Dennis Gewillig   Go to last post Go to first unread
Last post: 11/27/2020 9:19:19 AM(UTC)
Lansweeper Software deployment initiated by user
by  LS_enthusiast_4444   Go to last post Go to first unread
Last post: 11/26/2020 9:28:18 PM(UTC)
Lansweeper Help Desk not disabling for regular users?
by  FrankSc  
Go to last post Go to first unread
Last post: 11/26/2020 8:18:38 PM(UTC)