Event ID 4625: Server 2016 vs older OS's

[Peon]

Fellas,

Could someone please explain to me why MS Server 2016 displays remote ip or source ip of a failed login attempt but earlier Server versions do not.

You can with Security Policy drop security level from NTLM to User32 but that is risky. But then you can see the IP address of all login attempts.

Ive searched and looked but to the best of my ability I cant understand what Server 2016 does differently.

 

[DMNknight]

I cant tell you authoritatively, but from what I understand.

It's an improvement over previous bad logon attempts, but it's more about why the logon attempt rather than who.
Afaik, you used to have to troll netlogon.log in verbose mode to get some of the above information.

 

[Peon]

I cant tell you authoritatively, but from what I understand.

It's an improvement over previous bad logon attempts, but it's more about why the logon attempt rather than who.
Afaik, you used to have to troll netlogon.log in verbose mode to get some of the above information.

I know, you're right. I just wish I could drill down into some specific setting or mechanism. Technet doesnt provide much of an answer either.

 

[DMNknight]

I know, you're right. I just wish I could drill down into some specific setting or mechanism. Technet doesnt provide much of an answer either.

What is it that you are looking for? I have some experience in drilling down deep into where logs go to die

 

[Peon]

Will PM you now.