0

I am registering all RDP logon failures on my Windows servers through the IP address. In Windows Server 2012 R2, in Event 4624 the Event Viewer shows me the IP, while in Event 4625 it does not. I tested it on Windows 10 and it shows me the IP in the 2 events. Is there any way to have access to the IP address in Windows Server 2012 R2 without compromising the security of it? Does it have anything to do with the NTLM authentication method?

EDIT: I installed the Syspeace program and the same can find the IP's, so it is possible. Anyone have any ideas?

1

Doubtful.

Windows is quirky about which data is "instrumented" with errors and logs. There are occasional inconsistencies between versions of Windows for things like this. This has happened a number of times going back to the NT/2000 days.

I would test with Windows 8 and Server 2016 as well. If you see that Windows 8 and Server 2012 behave one way---while Windows 10 and Server 2016 behave another---then it is most likely another generational change.

  • But is there any way to get around this problem? There is no way to change the version of Windows Server ... – Bruno Gomes Mar 19 '18 at 16:38
  • Not that I'm aware of. You can control which events Windows logs easily, but there is generally not a way to adjust which data Windows logs for those events. – DoubleD Mar 19 '18 at 16:46
  • I installed the Syspeace program and the same can find the IP's, so it is possible. Anyone have any ideas? – Bruno Gomes Mar 26 '18 at 18:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.