Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I had enable the Advance Audit Policy Configuration on my Domain Controller.

Server OS - Window Server 2008 R2 Standard.

Client OS - Window XP

Whenever the Domain User enter wrong password for their account i received the following Failure Audit. In this log, the Client address shown is

Client Address: ::ffff: ( Please see the Print-screen attached ) enter image description here

But in Actual, the Client Address is different. Why it does not show the actual Client Address? Please let me know what does Client Address means here.

As per my understanding, it must be the address of the Client Workstation from where the Domain user had tried to login, but had failed because of, entering wrong password for their username.

Please explain?

share|improve this question

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.