Audit Active Directory failed logons

Audit Active Directory (AD) failed logons with ADAudit Plus

What is AD failed logon auditing

Every failed logon in AD generates a Windows Security event. Individually, a failed logon is routine. In volume, whether concentrated against specific accounts or spread across many accounts with a single password, failed logons are one of the clearest early signals of an attack in progress.

A brute-force attempt against a service account, a password spray campaign targeting your help desk team, stale credentials cached on a Windows service: all of them leave a trail in your Security event logs.

ADAudit Plus centralizes that trail. Rather than manually querying event logs on each DC, you get a consolidated view of every failed logon event across the domain, with the failure reason, source machine, IP address, and the DC that recorded it, all in pre-configured reports you can filter, schedule, and export without writing a single query.

Key details ADAudit Plus captures across failed logons

Trace failed logons to their source

ADAudit Plus surfaces every failed logon attempt across the domain with the failure reason, source machine, client IP address, and the DC that recorded it.

• The Logon Failures based on Users report groups all failures per user, so a single account accumulating failures across time or multiple source machines stands out immediately.
• Each lockout event presents the originating machine, IP address, and logon history for that account.
• The Account Lockout Analyzer identifies the source process so you can resolve the root cause rather than just unlocking the account and waiting for it to recur.

 

 

Identify the root cause of recurring AD account lockouts by analyzing components such as network drive mappings, process lists, applications, and more.

Detect attacks and anomalies

Brute-force attacks and password spray campaigns both use failed logon events as their mechanism, but they produce different patterns and require different detection approaches. ADAudit Plus handles both through per-user baseline analytics and the Attack Surface Analyzer, which detects brute-force and AD password spray as named indicators of compromise.

ADAudit Plus also leverages machine learning–driven user behavior analytics (UBA) to build behavioral baselines for each user using logon times, frequently accessed machines, and authentication activity, automatically flagging deviations without requiring manual threshold configuration.

• Unusual Volume of Logon Failure establishes a per-user baseline failure rate; when failures exceed a user's personal baseline, the anomaly is flagged immediately without a fixed domain-wide threshold.
• Unusual Logon Activity Time flags logon events occurring outside a user's established working hours.
• First Time Host Accessed by User flags the first time a user authenticates against a host they have never previously accessed, a lateral movement indicator.

 

 

Use machine learning to identify unusual logon failure spikes, abnormal logon activity times, first-time host access, and other anomalous behavior.

Monitor failed logons across hybrid environments

The Hybrid Logon Activity report correlates sign-in events for hybrid users across on-premises AD and Microsoft Entra ID in a single view, so you can see a full authentication picture for any user without switching between consoles or joining logs manually.

• The Entra ID Logon Failures report captures every failed sign-in attempt with the failure reason, application targeted, IP address, geo-location, device information, MFA result, and Conditional Access outcome.
• Risk detection reports surface sign-ins flagged by Microsoft Entra ID Identity Protection, including accounts identified in the Login by PasswordSpray Account report, sign-ins from anonymized IP addresses, and events matching the Login with leaked credentials report.
• The Logon Activity by Legacy Authentication report captures sign-ins using older protocols (SMTP, IMAP, POP3) that bypass MFA enforcement, a common attacker path in hybrid environments.

 

 

Gain a unified view of logon activity across your AD and Entra ID environments.

Get real-time alerts on failed logon events

ADAudit Plus ships with pre-configured alert profiles for the most critical failed logon scenarios. When an alert fires, your team is notified by email or SMS, and the alert can automatically create a ticket in your ITSM platform, routing the event to the responsible team before it is manually discovered.

Pre-configured alerts cover the following scenarios:

• When a disabled account attempts to log on, the Disabled Users Logon Attempt alert fires immediately, so attempts to authenticate with deprovisioned credentials are caught rather than logged silently.
• Account Lockout alerts notify your team the moment an account locks out, with the originating machine and lockout source already identified, so response begins with context rather than investigation.
• RADIUS Logon Failures alerts surface failed NPS authentication events at volume, useful for detecting credential attacks against wireless access points before they propagate.
• When an unusual volume of logon failures is detected against a user or host above their learned baseline, an alert fires so your team can act on the anomaly before it escalates.

Meet compliance requirements with logon failure audit trails

Most major compliance frameworks require organizations to log and retain authentication failure events as part of their access control and incident response obligations. ADAudit Plus provides pre-configured compliance reports mapped to each standard, so you are not building compliance views from scratch each audit cycle. The following standards are covered: SOX, HIPAA, PCI-DSS, FISMA, GLBA, GDPR, and ISO 27001.

Custom report profiles extend this further. You can combine specific users, failure types, time windows, and DCs into a saved profile that regenerates the same filtered view on demand, useful when your compliance team needs the same report repeated across quarterly or annual audit cycles without manual re-filtering each time.

Why native tools fall short

Windows records failed logon events in the Security event log on each DC, but reading those logs for investigation or compliance purposes requires working against the way they are structured. Several gaps make native tooling impractical at scale:

• Security event logs are stored locally on each DC, with no built-in aggregation across DCs. A failed logon attempt recorded on one DC does not automatically appear in the logs of another, so tracing a pattern across your domain means querying each DC separately.
• Event Viewer provides no root cause identification for account lockouts. It tells you which DC recorded the lockout event. It does not identify whether a scheduled task, mapped drive, or service caused it.
• PowerShell-based log queries can aggregate events across DCs, but they produce raw event data with no baseline for what normal looks like. There is no built-in comparison to determine whether a failure count is anomalous or within a user's typical range.
• Neither Event Viewer nor PowerShell sends real-time alerts. By the time you query a log, a brute-force attempt may already have succeeded or an account may have been locked out across the domain.

ADAudit Plus centralizes Security event log data from every DC, applies per-user baselines to surface anomalies, identifies lockout root causes automatically, and sends real-time alerts, so your response starts with context rather than with a query.