In my domain controller event log, I'm getting an account failure from a username of a service account.
The info is:
Security ID: DOMAIN\serviceaccount Account Name: serviceaccount Additional Information: Caller Computer Name: FreeRDP
This is really no help to me at all. I'm looking for an IP address, since any client can just 'tell' me who they are when they try to login. Is there any verbose or text based logging that I can check or implement to get source/destination IP, etc?
any client can just 'tell' me who they are when they try to login- What do you mean? Do you mean that you don't trust the Caller Computer Name that was logged in the event?