Event ID 5633 – A Request Was Made To Authenticate To A Wired Network.
|Sub-Category||Other Logon/Logoff Events|
|Type||Success Audit; Failure Audit|
|Description||A request was made to authenticate to a wired network|
When a network adapter connects to a new wired network and an 802.1x authentication attempt is made for that wired network, event 5633 is generated.
This log data provides the following information:
- Security ID
- Account Name
- Account Domain
- Logon ID
- Interface Name
- Reason Code
- Error Code
Why does event ID 5633 need to be monitored?
- To monitor the devices which are connecting to a network
- To monitor actions of high value accounts
- To detect anomalies and malicious actions
- To ensure non-active, external, and restricted accounts are not used
- To ensure that only white-listed accounts perform certain specific actions
- To enforce conventions and compliances
With in-depth reports, real-time alerts, and graphical displays, ADAudit Plus tracks network connections, helping you meet your security, operational, and compliance needs with absolute ease.
Event 5633 applies to the following operating systems:
- Windows 2008 R2 and 7
- Windows 2012 R2 and 8.1
- Windows 2016 and 10