Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am receiving lots of Failure Audit logs on my DC, can you guide me - how should i identify the culprit.

Please see the below print-screen for more detail. The logon type is 3, that means it is a network logon. I have identify the Workstation from the log, but how should i prove who or which process is sending broadcast with logon authentication to my DC. The Anti-virus is also updated.

Note:- The Workstation is in Workgroup.enter image description here

share|improve this question

use tcp view on the workstation it will tell you the process that is talking to the dc.

share|improve this answer

As you said, your anti virus is updated, just perform virus scanning on all workstations or turn on IIS logging.

Refer the following link for error event: event id 4625

The thread can also be monitored by a third party tool.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.