I want to whitelist events when users put the password in the logon window during login.
See example below, note the *****:
An account failed to log on.
Subject:
Security ID: SYSTEM
Account Name: Computer01
Account Domain: MyDomain
Logon ID: 0x3E7
Logon Type: 7
Account For Which Logon Failed:
Security ID: NULL SID
Account Name: User
Account Domain: MyDomain
Failure Information:
Failure Reason: Unknown user name or bad password.
Status: 0xC000006D **************
Sub Status: 0xC000006A
Process Information:
Caller Process ID: 0x8e0D
Caller Process Name: C:\Windows\System32\svchost.exe
Network Information:
Workstation Name: Computer01
Source Network Address: 127.0.0.1
Source Port: 0
Detailed Authentication Information:
Logon Process: User32
Authentication Package: Negotiate
Transited Services: -
Package Name (NTLM only): -
Key Length: 0
My whitelist is as follows:
whitelist = EventCode = "4625" Message = "Failure\sInformation\sStatus:\s+0xc000006d"
Need assistance with coding the 0xc000006d
Thank you!
