Logon Logoff Event: 531

Event ID 531 – Logon Failure: Account Currently Disabled

When a user attempts to log on to a workstation or server with a disabled account, event 531 is generated. This event is also registered on workstations and servers when a user attempts to logon using a local SAM or domain account. This particular action will also trigger a corresponding failure event in the Account Logon category.

This log data provides the following information:

• User Name
• Domain
• Logon Type
• Logon Process
• Authentication Package
• Workstation Name

Additionally, in Windows Server 2003, the following information is also made available:

• Caller User Name
• Caller Domain
• Caller Logon ID
• Caller Process ID
• Transited Services
• Source Network Address
• Source Port

Why does event ID 531 need to be monitored?

• To detect brute-force, dictionary, and other password guess attacks.
• To detect abnormal and possibly malicious internal activity.
• To come up with a benchmark for the account lockout threshold policy.
• To ensure compliance with regulatory mandates.

Pro Tip:

With in-depth reports, real-time alerts, and graphical displays, ADAudit Plus tracks logon failures, helping you meet your security, operational, and compliance needs with absolute ease.