Regresar
-
Título
Activity Report shows, "Failed login from Unknown" event with a username of "Unspecified" -
Descripción
In reviewing audit reports, there are multiple failed login events that do not specify a valid source address or username. -
Causa
Upon investigation, these entries in the report were determined to come from the Windows Security Event Log for Event ID 4625.
The TPAM code responsible for processing these events likely experienced an issue parsing that data which caused the address to show as unknown. -
Resolución
If this is a one time event that is not reproducible, it should not considered to be a critical issue and should not cause concern.
If the issue is reproducible and/or the issue has occurred on multiple occasions, please submit an Support Service Request and supply a copy of the logs in question for further review.