In my domain controller event log, I'm getting an account failure from a username of a service account.
The info is:

Security ID: DOMAIN\serviceaccount
Account Name: serviceaccount
Additional Information: 

Caller Computer Name: FreeRDP

This is really no help to me at all. I'm looking for an IP address, since any client can just 'tell' me who they are when they try to login. Is there any verbose or text based logging that I can check or implement to get source/destination IP, etc?

  • any client can just 'tell' me who they are when they try to login - What do you mean? Do you mean that you don't trust the Caller Computer Name that was logged in the event?
    – joeqwerty
    Commented Apr 25, 2016 at 16:46
  • exactly that, yes Commented Apr 25, 2016 at 16:56
  • 2
    Playing Devil's Advocate then; If you don't trust the Event Log, why would you trust any other log? Additionally, how do you imagine the client would/could "spoof" it's name. I'm trying to understand your concern.
    – joeqwerty
    Commented Apr 25, 2016 at 17:00

1 Answer 1


The security event log does not provide every conceivable piece of information. If you need more details, install and use SysMon:


Network logging is not enabled by default, you would need to include the -n switch.

sysmon -accepteula –i –h sha1,sha256 –n  
  • Great, this looks like the right tool for the job. I'm looking for tracking events and network activity related to logins only. Can you provide insight to this configuration? I'll also see what I can find from Googling and testing, as well Commented Apr 27, 2016 at 16:27

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .