{"id":21820,"date":"2026-09-13T17:10:53","date_gmt":"2026-09-13T13:40:53","guid":{"rendered":"https:\/\/maralhost.com\/kb\/docs\/windows\/%d8%a2%d9%85%d9%88%d8%b2%d8%b4-%d9%be%db%8c%d8%af%d8%a7-%da%a9%d8%b1%d8%af%d9%86-login%d9%87%d8%a7%db%8c-%d9%86%d8%a7%d9%85%d9%88%d9%81%d9%82-%d8%af%d8%b1-windows-server\/"},"modified":"2026-09-13T17:18:29","modified_gmt":"2026-09-13T13:48:29","slug":"finding-failed-logins-in-windows-server","status":"publish","type":"docs","link":"https:\/\/maralhost.com\/kb\/docs\/windows\/finding-failed-logins-in-windows-server\/","title":{"rendered":"\u0622\u0645\u0648\u0632\u0634 \u067e\u06cc\u062f\u0627 \u06a9\u0631\u062f\u0646 Login\u0647\u0627\u06cc \u0646\u0627\u0645\u0648\u0641\u0642 \u062f\u0631 Windows Server"},"content":{"rendered":"\n<h2 class=\"wp-block-heading\">\u0645\u0642\u062f\u0645\u0647<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">\u062f\u0631 <strong>Windows Server 2025<\/strong> \u062a\u0644\u0627\u0634\u200c\u0647\u0627\u06cc \u0646\u0627\u0645\u0648\u0641\u0642 \u0628\u0631\u0627\u06cc \u0648\u0631\u0648\u062f \u06a9\u0627\u0631\u0628\u0631\u0627\u0646 \u062f\u0631 <strong>Security Log<\/strong> \u062b\u0628\u062a \u0645\u06cc\u200c\u0634\u0648\u0646\u062f. \u0645\u0647\u0645\u200c\u062a\u0631\u06cc\u0646 Event \u0628\u0631\u0627\u06cc \u0628\u0631\u0631\u0633\u06cc \u0627\u06cc\u0646 \u0645\u0648\u0636\u0648\u0639:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Event ID: 4625\nSource: Microsoft-Windows-Security-Auditing\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u0633\u062a.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Event ID <code>4625<\/code> \u0632\u0645\u0627\u0646\u06cc \u062b\u0628\u062a \u0645\u06cc\u200c\u0634\u0648\u062f \u06a9\u0647 \u06cc\u06a9 Logon \u0646\u0627\u0645\u0648\u0641\u0642 \u0631\u062e \u062f\u0647\u062f \u0648 \u0645\u0639\u0645\u0648\u0644\u0627\u064b \u0627\u0637\u0644\u0627\u0639\u0627\u062a\u06cc \u0645\u0627\u0646\u0646\u062f <strong>Username\u060c Logon Type\u060c Source IP\u060c Workstation\u060c Failure Reason\u060c Status \u0648 Sub Status<\/strong> \u0631\u0627 \u062f\u0631 \u0627\u062e\u062a\u06cc\u0627\u0631 Administrator \u0642\u0631\u0627\u0631 \u0645\u06cc\u200c\u062f\u0647\u062f. \u0627\u06cc\u0646 Event \u0631\u0648\u06cc \u0633\u06cc\u0633\u062a\u0645\u06cc \u062b\u0628\u062a \u0645\u06cc\u200c\u0634\u0648\u062f \u06a9\u0647 \u062a\u0644\u0627\u0634 \u0628\u0631\u0627\u06cc Logon \u0631\u0648\u06cc \u0622\u0646 \u0627\u0646\u062c\u0627\u0645 \u0634\u062f\u0647 \u0627\u0633\u062a.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u06cc\u0646 Log \u0628\u0631\u0627\u06cc \u0628\u0631\u0631\u0633\u06cc \u0645\u0648\u0627\u0631\u062f\u06cc \u0645\u0627\u0646\u0646\u062f \u062a\u0644\u0627\u0634 \u0646\u0627\u0645\u0648\u0641\u0642 RDP\u060c Password \u0627\u0634\u062a\u0628\u0627\u0647\u060c Account \u063a\u06cc\u0631\u0641\u0639\u0627\u0644\u060c Account Lockout \u0648 \u062a\u0644\u0627\u0634\u200c\u0647\u0627\u06cc \u0645\u062a\u0639\u062f\u062f \u0645\u0634\u06a9\u0648\u06a9 \u06a9\u0627\u0631\u0628\u0631\u062f \u062f\u0627\u0631\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Event ID \u0627\u0635\u0644\u06cc \u0628\u0631\u0627\u06cc Failed Login<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc \u067e\u06cc\u062f\u0627 \u06a9\u0631\u062f\u0646 Login \u0646\u0627\u0645\u0648\u0641\u0642\u060c \u0645\u0647\u0645\u200c\u062a\u0631\u06cc\u0646 Event:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>4625\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u0633\u062a.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0639\u0646\u0648\u0627\u0646 Event:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>An account failed to log on.\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0645\u0633\u06cc\u0631 \u0645\u0634\u0627\u0647\u062f\u0647 \u0622\u0646:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Event Viewer\nWindows Logs\nSecurity\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Microsoft \u0627\u0639\u0644\u0627\u0645 \u0645\u06cc\u200c\u06a9\u0646\u062f Event <code>4625<\/code> \u0628\u0631\u0627\u06cc Logon Failure \u062b\u0628\u062a \u0645\u06cc\u200c\u0634\u0648\u062f \u0648 \u0631\u0648\u06cc Domain Controller\u060c Member Server \u0648 Workstation \u0642\u0627\u0628\u0644 \u0645\u0634\u0627\u0647\u062f\u0647 \u0627\u0633\u062a.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<figure class=\"wp-block-image size-large\"><img fetchpriority=\"high\" decoding=\"async\" width=\"819\" height=\"1024\" src=\"https:\/\/maralhost.com\/kb\/wp-content\/uploads\/2026\/09\/Finding-Failed-Logins-in-Windows-Server1-819x1024.webp\" alt=\"\" class=\"wp-image-21825\" title=\"\" srcset=\"https:\/\/maralhost.com\/kb\/wp-content\/uploads\/2026\/09\/Finding-Failed-Logins-in-Windows-Server1-819x1024.webp 819w, https:\/\/maralhost.com\/kb\/wp-content\/uploads\/2026\/09\/Finding-Failed-Logins-in-Windows-Server1-240x300.webp 240w, https:\/\/maralhost.com\/kb\/wp-content\/uploads\/2026\/09\/Finding-Failed-Logins-in-Windows-Server1-767x959.webp 767w, https:\/\/maralhost.com\/kb\/wp-content\/uploads\/2026\/09\/Finding-Failed-Logins-in-Windows-Server1.webp 1122w\" sizes=\"(max-width: 819px) 100vw, 819px\" \/><\/figure>\n\n\n\n<h1 class=\"wp-block-heading\">\u0645\u0631\u062d\u0644\u0647 1: \u0628\u0627\u0632 \u06a9\u0631\u062f\u0646 Event Viewer<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u062f\u0631 Windows Server 2025 \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u06cc\u062f \u0627\u0632 \u0645\u0633\u06cc\u0631 \u0632\u06cc\u0631 \u0648\u0627\u0631\u062f Event Viewer \u0634\u0648\u06cc\u062f:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Server Manager\nTools\nEvent Viewer\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0631\u0648\u0634 \u0633\u0631\u06cc\u0639\u200c\u062a\u0631:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Win + R\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0633\u067e\u0633:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>eventvwr.msc\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0631\u0627 \u0627\u062c\u0631\u0627 \u06a9\u0646\u06cc\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0645\u0631\u062d\u0644\u0647 2: \u0648\u0631\u0648\u062f \u0628\u0647 Security Log<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u067e\u0633 \u0627\u0632 \u0628\u0627\u0632 \u0634\u062f\u0646 Event Viewer \u0645\u0633\u06cc\u0631 \u0632\u06cc\u0631 \u0631\u0627 \u0628\u0627\u0632 \u06a9\u0646\u06cc\u062f:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Event Viewer (Local)\nWindows Logs\nSecurity\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u062f\u0631 \u0642\u0633\u0645\u062a \u0645\u0631\u06a9\u0632\u06cc \u062a\u0639\u062f\u0627\u062f \u0632\u06cc\u0627\u062f\u06cc Security Event \u0646\u0645\u0627\u06cc\u0634 \u062f\u0627\u062f\u0647 \u062e\u0648\u0627\u0647\u062f \u0634\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0645\u0631\u062d\u0644\u0647 3: \u0641\u06cc\u0644\u062a\u0631 \u06a9\u0631\u062f\u0646 Event ID 4625<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0631\u0648\u06cc:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Security\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u06a9\u0644\u06cc\u06a9 \u06a9\u0646\u06cc\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u0632 \u067e\u0646\u0644 \u0633\u0645\u062a \u0631\u0627\u0633\u062a:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Filter Current Log...\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0631\u0627 \u0627\u0646\u062a\u062e\u0627\u0628 \u06a9\u0646\u06cc\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u062f\u0631 \u0642\u0633\u0645\u062a:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>&lt;All Event IDs&gt;\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0645\u0642\u062f\u0627\u0631 \u0632\u06cc\u0631 \u0631\u0627 \u0648\u0627\u0631\u062f \u06a9\u0646\u06cc\u062f:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>4625\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0633\u067e\u0633:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>OK\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0631\u0627 \u0628\u0632\u0646\u06cc\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u06a9\u0646\u0648\u0646 \u0641\u0642\u0637 Login\u0647\u0627\u06cc \u0646\u0627\u0645\u0648\u0641\u0642 \u0646\u0645\u0627\u06cc\u0634 \u062f\u0627\u062f\u0647 \u0645\u06cc\u200c\u0634\u0648\u0646\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0645\u0631\u062d\u0644\u0647 4: \u0645\u062d\u062f\u0648\u062f \u06a9\u0631\u062f\u0646 \u0628\u0627\u0632\u0647 \u0632\u0645\u0627\u0646\u06cc<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u06af\u0631 \u0632\u0645\u0627\u0646 \u062a\u0642\u0631\u06cc\u0628\u06cc \u0645\u0634\u06a9\u0644 \u0631\u0627 \u0645\u06cc\u200c\u062f\u0627\u0646\u06cc\u062f\u060c \u062f\u0631 \u0642\u0633\u0645\u062a:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Logged\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u06cc\u06a9\u06cc \u0627\u0632 \u06af\u0632\u06cc\u0646\u0647\u200c\u0647\u0627\u06cc \u0645\u0646\u0627\u0633\u0628 \u0631\u0627 \u0627\u0646\u062a\u062e\u0627\u0628 \u06a9\u0646\u06cc\u062f:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Last hour\nLast 12 hours\nLast 24 hours\nLast 7 days\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0645\u062b\u0644\u0627\u064b \u0627\u06af\u0631 \u06a9\u0627\u0631\u0628\u0631 \u0627\u0639\u0644\u0627\u0645 \u06a9\u0631\u062f\u0647 \u0627\u0633\u062a \u0637\u06cc \u06cc\u06a9 \u0633\u0627\u0639\u062a \u06af\u0630\u0634\u062a\u0647 \u0646\u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u0633\u062a\u0647 \u0648\u0627\u0631\u062f Server \u0634\u0648\u062f\u060c \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0627\u0632:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Last hour\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0627\u0639\u062b \u0645\u06cc\u200c\u0634\u0648\u062f \u062a\u0639\u062f\u0627\u062f Event\u0647\u0627 \u0628\u0633\u06cc\u0627\u0631 \u06a9\u0645\u062a\u0631 \u0634\u0648\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0645\u0631\u062d\u0644\u0647 5: \u0628\u0627\u0632 \u06a9\u0631\u062f\u0646 Event 4625<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0631\u0648\u06cc \u06cc\u06a9\u06cc \u0627\u0632 Event\u0647\u0627\u06cc <code>4625<\/code> \u062f\u0648 \u0628\u0627\u0631 \u06a9\u0644\u06cc\u06a9 \u06a9\u0646\u06cc\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u062f\u0631 \u0642\u0633\u0645\u062a:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>General\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u0637\u0644\u0627\u0639\u0627\u062a\u06cc \u0634\u0628\u06cc\u0647 \u0645\u0648\u0627\u0631\u062f \u0632\u06cc\u0631 \u062f\u06cc\u062f\u0647 \u0645\u06cc\u200c\u0634\u0648\u062f:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Account For Which Logon Failed\nFailure Information\nProcess Information\nNetwork Information\nDetailed Authentication Information\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u06cc\u0646 \u0642\u0633\u0645\u062a\u200c\u0647\u0627 \u0628\u0631\u0627\u06cc \u067e\u06cc\u062f\u0627 \u06a9\u0631\u062f\u0646 \u0639\u0644\u062a Failed Login \u0627\u0647\u0645\u06cc\u062a \u0632\u06cc\u0627\u062f\u06cc \u062f\u0627\u0631\u0646\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0645\u0647\u0645\u200c\u062a\u0631\u06cc\u0646 \u0627\u0637\u0644\u0627\u0639\u0627\u062a Event 4625<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0647\u0646\u06af\u0627\u0645 \u0628\u0631\u0631\u0633\u06cc \u06cc\u06a9 Failed Login \u0631\u0648\u06cc \u0627\u06cc\u0646 \u0645\u0648\u0627\u0631\u062f \u062a\u0645\u0631\u06a9\u0632 \u06a9\u0646\u06cc\u062f:<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><thead><tr><th class=\"has-text-align-center\" data-align=\"center\">\u0641\u06cc\u0644\u062f<\/th><th class=\"has-text-align-center\" data-align=\"center\">\u06a9\u0627\u0631\u0628\u0631\u062f<\/th><\/tr><\/thead><tbody><tr><td class=\"has-text-align-center\" data-align=\"center\">Account Name<\/td><td class=\"has-text-align-center\" data-align=\"center\">Username \u0645\u0648\u0631\u062f \u0627\u0633\u062a\u0641\u0627\u062f\u0647<\/td><\/tr><tr><td class=\"has-text-align-center\" data-align=\"center\">Account Domain<\/td><td class=\"has-text-align-center\" data-align=\"center\">Domain \u06cc\u0627 Computer \u0645\u0631\u0628\u0648\u0637 \u0628\u0647 Account<\/td><\/tr><tr><td class=\"has-text-align-center\" data-align=\"center\">Failure Reason<\/td><td class=\"has-text-align-center\" data-align=\"center\">\u0639\u0644\u062a \u06a9\u0644\u06cc Failure<\/td><\/tr><tr><td class=\"has-text-align-center\" data-align=\"center\">Status<\/td><td class=\"has-text-align-center\" data-align=\"center\">\u06a9\u062f \u0627\u0635\u0644\u06cc \u062e\u0637\u0627<\/td><\/tr><tr><td class=\"has-text-align-center\" data-align=\"center\">Sub Status<\/td><td class=\"has-text-align-center\" data-align=\"center\">\u062c\u0632\u0626\u06cc\u0627\u062a \u0628\u06cc\u0634\u062a\u0631 \u062e\u0637\u0627<\/td><\/tr><tr><td class=\"has-text-align-center\" data-align=\"center\">Logon Type<\/td><td class=\"has-text-align-center\" data-align=\"center\">\u0646\u0648\u0639 Login<\/td><\/tr><tr><td class=\"has-text-align-center\" data-align=\"center\">Workstation Name<\/td><td class=\"has-text-align-center\" data-align=\"center\">\u0633\u06cc\u0633\u062a\u0645 \u0645\u0628\u062f\u0623<\/td><\/tr><tr><td class=\"has-text-align-center\" data-align=\"center\">Source Network Address<\/td><td class=\"has-text-align-center\" data-align=\"center\">IP \u0645\u0628\u062f\u0623<\/td><\/tr><tr><td class=\"has-text-align-center\" data-align=\"center\">Source Port<\/td><td class=\"has-text-align-center\" data-align=\"center\">Port \u0645\u0628\u062f\u0623<\/td><\/tr><tr><td class=\"has-text-align-center\" data-align=\"center\">Caller Process Name<\/td><td class=\"has-text-align-center\" data-align=\"center\">Process \u0627\u06cc\u062c\u0627\u062f\u06a9\u0646\u0646\u062f\u0647 \u062a\u0644\u0627\u0634<\/td><\/tr><tr><td class=\"has-text-align-center\" data-align=\"center\">Authentication Package<\/td><td class=\"has-text-align-center\" data-align=\"center\">\u0631\u0648\u0634 Authentication<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Microsoft \u0627\u06cc\u0646 \u0627\u0637\u0644\u0627\u0639\u0627\u062a \u0631\u0627 \u0628\u0647\u200c\u0639\u0646\u0648\u0627\u0646 \u0628\u062e\u0634\u200c\u0647\u0627\u06cc \u0627\u0635\u0644\u06cc Event <code>4625<\/code> \u0645\u0633\u062a\u0646\u062f \u06a9\u0631\u062f\u0647 \u0627\u0633\u062a.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u067e\u06cc\u062f\u0627 \u06a9\u0631\u062f\u0646 Username<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u062f\u0631 Event \u0628\u0647 \u0642\u0633\u0645\u062a:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Account For Which Logon Failed\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0648\u06cc\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0641\u06cc\u0644\u062f:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Account Name\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Username\u0627\u06cc \u0631\u0627 \u0646\u0634\u0627\u0646 \u0645\u06cc\u200c\u062f\u0647\u062f \u06a9\u0647 \u0628\u0631\u0627\u06cc Login \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0634\u062f\u0647 \u0627\u0633\u062a.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc \u0645\u062b\u0627\u0644:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Account Name: Administrator\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u06cc\u0627:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Account Name: serveradmin\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u06af\u0631 Username \u0648\u062c\u0648\u062f \u0646\u062f\u0627\u0634\u062a\u0647 \u0628\u0627\u0634\u062f \u06cc\u0627 \u0627\u0634\u062a\u0628\u0627\u0647 \u0648\u0627\u0631\u062f \u0634\u062f\u0647 \u0628\u0627\u0634\u062f\u060c Status \u0645\u0631\u0628\u0648\u0637\u0647 \u0646\u06cc\u0632 \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u062f \u0627\u06cc\u0646 \u0645\u0648\u0636\u0648\u0639 \u0631\u0627 \u0645\u0634\u062e\u0635 \u06a9\u0646\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u067e\u06cc\u062f\u0627 \u06a9\u0631\u062f\u0646 Source IP<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc Login\u0647\u0627\u06cc Remote\u060c \u06cc\u06a9\u06cc \u0627\u0632 \u0645\u0647\u0645\u200c\u062a\u0631\u06cc\u0646 \u0641\u06cc\u0644\u062f\u0647\u0627:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Source Network Address\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u0633\u062a.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc \u0645\u062b\u0627\u0644:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Source Network Address: 203.0.113.25\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u06cc\u0646 IP \u0633\u06cc\u0633\u062a\u0645\u06cc \u0627\u0633\u062a \u06a9\u0647 Logon Attempt \u0627\u0632 \u0622\u0646 \u0627\u0646\u062c\u0627\u0645 \u0634\u062f\u0647 \u0627\u0633\u062a. Microsoft \u0646\u06cc\u0632 \u0627\u06cc\u0646 \u0641\u06cc\u0644\u062f \u0631\u0627 IP \u0645\u0628\u062f\u0623 Logon Attempt \u062a\u0639\u0631\u06cc\u0641 \u0645\u06cc\u200c\u06a9\u0646\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u06af\u0631 \u0645\u0642\u062f\u0627\u0631 \u0632\u06cc\u0631 \u062f\u06cc\u062f\u0647 \u0634\u0648\u062f:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>127.0.0.1\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u06cc\u0627:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>::1\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u062a\u0644\u0627\u0634 \u0627\u0632 \u062e\u0648\u062f Server \u0627\u0646\u062c\u0627\u0645 \u0634\u062f\u0647 \u0627\u0633\u062a.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u067e\u06cc\u062f\u0627 \u06a9\u0631\u062f\u0646 Failed RDP Login<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc \u0628\u0631\u0631\u0633\u06cc \u062a\u0644\u0627\u0634\u200c\u0647\u0627\u06cc \u0646\u0627\u0645\u0648\u0641\u0642 Remote Desktop \u0639\u0644\u0627\u0648\u0647 \u0628\u0631 Event ID <code>4625<\/code> \u0628\u0627\u06cc\u062f:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Logon Type\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0631\u0627 \u0646\u06cc\u0632 \u0628\u0631\u0631\u0633\u06cc \u06a9\u0646\u06cc\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc RDP \u0645\u0639\u0645\u0648\u0644\u0627\u064b:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Logon Type: 10\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0646\u0645\u0627\u06cc\u0634 \u062f\u0627\u062f\u0647 \u0645\u06cc\u200c\u0634\u0648\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Microsoft Logon Type <code>10<\/code> \u0631\u0627 \u0628\u0647\u200c\u0639\u0646\u0648\u0627\u0646:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>RemoteInteractive\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0648 \u0645\u0631\u0628\u0648\u0637 \u0628\u0647 Remote Desktop \u06cc\u0627 Terminal Services \u0645\u0639\u0631\u0641\u06cc \u0645\u06cc\u200c\u06a9\u0646\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0646\u0627\u0628\u0631\u0627\u06cc\u0646 \u06cc\u06a9 Failed RDP Login \u0645\u0639\u0645\u0648\u0644\u0627\u064b \u0634\u0628\u06cc\u0647 \u0627\u06cc\u0646 \u0627\u0633\u062a:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Event ID: 4625\nLogon Type: 10\nAccount Name: Administrator\nSource Network Address: 203.0.113.25\n<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Logon Type\u0647\u0627\u06cc \u0645\u0647\u0645<\/h1>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><thead><tr><th class=\"has-text-align-center\" data-align=\"center\">Logon Type<\/th><th class=\"has-text-align-center\" data-align=\"center\">\u0645\u0641\u0647\u0648\u0645<\/th><\/tr><\/thead><tbody><tr><td class=\"has-text-align-center\" data-align=\"center\"><code>2<\/code><\/td><td class=\"has-text-align-center\" data-align=\"center\">Interactive \/ Login \u0645\u062d\u0644\u06cc<\/td><\/tr><tr><td class=\"has-text-align-center\" data-align=\"center\"><code>3<\/code><\/td><td class=\"has-text-align-center\" data-align=\"center\">Network<\/td><\/tr><tr><td class=\"has-text-align-center\" data-align=\"center\"><code>4<\/code><\/td><td class=\"has-text-align-center\" data-align=\"center\">Batch<\/td><\/tr><tr><td class=\"has-text-align-center\" data-align=\"center\"><code>5<\/code><\/td><td class=\"has-text-align-center\" data-align=\"center\">Service<\/td><\/tr><tr><td class=\"has-text-align-center\" data-align=\"center\"><code>7<\/code><\/td><td class=\"has-text-align-center\" data-align=\"center\">Unlock<\/td><\/tr><tr><td class=\"has-text-align-center\" data-align=\"center\"><code>8<\/code><\/td><td class=\"has-text-align-center\" data-align=\"center\">NetworkCleartext<\/td><\/tr><tr><td class=\"has-text-align-center\" data-align=\"center\"><code>9<\/code><\/td><td class=\"has-text-align-center\" data-align=\"center\">NewCredentials<\/td><\/tr><tr><td class=\"has-text-align-center\" data-align=\"center\"><code>10<\/code><\/td><td class=\"has-text-align-center\" data-align=\"center\">RemoteInteractive \/ RDP<\/td><\/tr><tr><td class=\"has-text-align-center\" data-align=\"center\"><code>11<\/code><\/td><td class=\"has-text-align-center\" data-align=\"center\">CachedInteractive<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u06cc\u0646 \u0645\u0642\u0627\u062f\u06cc\u0631 \u062f\u0631 \u0645\u0633\u062a\u0646\u062f \u0631\u0633\u0645\u06cc Event <code>4625<\/code> Microsoft \u062a\u0639\u0631\u06cc\u0641 \u0634\u062f\u0647\u200c\u0627\u0646\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u062a\u0641\u0627\u0648\u062a Logon Type 3 \u0648 10<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u06cc\u06a9\u06cc \u0627\u0632 \u0627\u0634\u062a\u0628\u0627\u0647\u0627\u062a \u0631\u0627\u06cc\u062c \u0627\u06cc\u0646 \u0627\u0633\u062a \u06a9\u0647 \u0647\u0631 Login \u0627\u0632 Network \u0631\u0627 RDP \u062f\u0631 \u0646\u0638\u0631 \u0628\u06af\u06cc\u0631\u06cc\u0645.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Logon Type 10<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">\u0645\u0639\u0645\u0648\u0644\u0627\u064b:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Remote Desktop\nTerminal Services\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">Logon Type 3<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">\u0645\u0639\u0645\u0648\u0644\u0627\u064b \u0645\u0631\u0628\u0648\u0637 \u0628\u0647 Network Logon \u0627\u0633\u062a\u060c \u0645\u0627\u0646\u0646\u062f \u062f\u0633\u062a\u0631\u0633\u06cc \u0628\u0647:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>SMB\nFile Share\nNetwork Resource\nRemote service\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0646\u0627\u0628\u0631\u0627\u06cc\u0646 \u0628\u0631\u0627\u06cc \u0628\u0631\u0631\u0633\u06cc RDP Failed Login\u060c \u0641\u0642\u0637 Event ID <code>4625<\/code> \u06a9\u0627\u0641\u06cc \u0646\u06cc\u0633\u062a \u0648 Logon Type \u0646\u06cc\u0632 \u0628\u0627\u06cc\u062f \u0628\u0631\u0631\u0633\u06cc \u0634\u0648\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0628\u0631\u0631\u0633\u06cc Failure Reason<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u062f\u0631 Event <code>4625<\/code> \u0642\u0633\u0645\u062a:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Failure Information\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0631\u0627 \u067e\u06cc\u062f\u0627 \u06a9\u0646\u06cc\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0645\u0648\u0627\u0631\u062f \u0645\u0647\u0645:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Failure Reason\nStatus\nSub Status\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0647\u0633\u062a\u0646\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u06cc\u0646 \u0627\u0637\u0644\u0627\u0639\u0627\u062a \u0645\u0639\u0645\u0648\u0644\u0627\u064b \u062f\u0642\u06cc\u0642\u200c\u062a\u0631 \u0627\u0632 \u0645\u062a\u0646 \u0627\u0628\u062a\u062f\u0627\u06cc\u06cc Event \u0646\u0634\u0627\u0646 \u0645\u06cc\u200c\u062f\u0647\u0646\u062f \u0686\u0631\u0627 Login \u0627\u0646\u062c\u0627\u0645 \u0646\u0634\u062f\u0647 \u0627\u0633\u062a.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u06a9\u062f\u0647\u0627\u06cc \u0631\u0627\u06cc\u062c Failed Login<\/h1>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><thead><tr><th class=\"has-text-align-center\" data-align=\"center\">Status \/ Sub Status<\/th><th class=\"has-text-align-center\" data-align=\"center\">\u0645\u0641\u0647\u0648\u0645<\/th><\/tr><\/thead><tbody><tr><td class=\"has-text-align-center\" data-align=\"center\"><code>0xC0000064<\/code><\/td><td class=\"has-text-align-center\" data-align=\"center\">Username \u0648\u062c\u0648\u062f \u0646\u062f\u0627\u0631\u062f \u06cc\u0627 \u0627\u0634\u062a\u0628\u0627\u0647 \u0627\u0633\u062a<\/td><\/tr><tr><td class=\"has-text-align-center\" data-align=\"center\"><code>0xC000006A<\/code><\/td><td class=\"has-text-align-center\" data-align=\"center\">Password \u0627\u0634\u062a\u0628\u0627\u0647 \u0627\u0633\u062a<\/td><\/tr><tr><td class=\"has-text-align-center\" data-align=\"center\"><code>0xC000006D<\/code><\/td><td class=\"has-text-align-center\" data-align=\"center\">Username \u06cc\u0627 Authentication Information \u0635\u062d\u06cc\u062d \u0646\u06cc\u0633\u062a<\/td><\/tr><tr><td class=\"has-text-align-center\" data-align=\"center\"><code>0xC000006F<\/code><\/td><td class=\"has-text-align-center\" data-align=\"center\">Login \u062e\u0627\u0631\u062c \u0627\u0632 \u0633\u0627\u0639\u0627\u062a \u0645\u062c\u0627\u0632<\/td><\/tr><tr><td class=\"has-text-align-center\" data-align=\"center\"><code>0xC0000070<\/code><\/td><td class=\"has-text-align-center\" data-align=\"center\">Login \u0627\u0632 Workstation \u063a\u06cc\u0631\u0645\u062c\u0627\u0632<\/td><\/tr><tr><td class=\"has-text-align-center\" data-align=\"center\"><code>0xC0000072<\/code><\/td><td class=\"has-text-align-center\" data-align=\"center\">Account \u063a\u06cc\u0631\u0641\u0639\u0627\u0644 \u0627\u0633\u062a<\/td><\/tr><tr><td class=\"has-text-align-center\" data-align=\"center\"><code>0xC000015B<\/code><\/td><td class=\"has-text-align-center\" data-align=\"center\">User \u0627\u062c\u0627\u0632\u0647 \u0627\u06cc\u0646 \u0646\u0648\u0639 Logon \u0631\u0627 \u0646\u062f\u0627\u0631\u062f<\/td><\/tr><tr><td class=\"has-text-align-center\" data-align=\"center\"><code>0xC0000193<\/code><\/td><td class=\"has-text-align-center\" data-align=\"center\">Account \u0645\u0646\u0642\u0636\u06cc \u0634\u062f\u0647 \u0627\u0633\u062a<\/td><\/tr><tr><td class=\"has-text-align-center\" data-align=\"center\"><code>0xC0000234<\/code><\/td><td class=\"has-text-align-center\" data-align=\"center\">Account \u0642\u0641\u0644 \u0634\u062f\u0647 \u0627\u0633\u062a<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Microsoft \u062a\u0648\u0635\u06cc\u0647 \u0645\u06cc\u200c\u06a9\u0646\u062f \u062a\u06a9\u0631\u0627\u0631 \u062e\u0637\u0627\u0647\u0627\u06cc\u06cc \u0645\u0627\u0646\u0646\u062f <code>0xC0000064<\/code> \u0648 <code>0xC000006A<\/code> \u0628\u0647\u200c\u062e\u0635\u0648\u0635 \u0628\u0631\u0627\u06cc Account\u0647\u0627\u06cc \u0645\u0647\u0645 \u0628\u0631\u0631\u0633\u06cc \u0634\u0648\u062f\u060c \u0632\u06cc\u0631\u0627 \u062a\u0639\u062f\u0627\u062f \u0632\u06cc\u0627\u062f \u0622\u0646\u200c\u0647\u0627 \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u062f \u0646\u0634\u0627\u0646\u0647 Password Guessing \u06cc\u0627 User Enumeration \u0628\u0627\u0634\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0645\u062b\u0627\u0644 Password \u0627\u0634\u062a\u0628\u0627\u0647<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc \u0645\u062b\u0627\u0644:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Event ID: 4625\nAccount Name: Administrator\nLogon Type: 10\nSource Network Address: 203.0.113.25\nStatus: 0xC000006D\nSub Status: 0xC000006A\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\"><code>0xC000006A<\/code> \u0645\u0639\u0645\u0648\u0644\u0627\u064b \u0646\u0634\u0627\u0646\u200c\u062f\u0647\u0646\u062f\u0647 Password \u0627\u0634\u062a\u0628\u0627\u0647 \u0627\u0633\u062a.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u06af\u0631 \u062a\u0639\u062f\u0627\u062f \u0632\u06cc\u0627\u062f\u06cc \u0627\u0632 \u0627\u06cc\u0646 Event\u0647\u0627 \u0627\u0632 \u06cc\u06a9 IP \u0645\u0634\u062e\u0635 \u0645\u0634\u0627\u0647\u062f\u0647 \u0634\u0648\u062f\u060c \u0628\u0627\u06cc\u062f \u0645\u0648\u0636\u0648\u0639 \u0628\u06cc\u0634\u062a\u0631 \u0628\u0631\u0631\u0633\u06cc \u0634\u0648\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0645\u062b\u0627\u0644 Username \u0627\u0634\u062a\u0628\u0627\u0647<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u06af\u0631:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Status: 0xC000006D\nSub Status: 0xC0000064\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0646\u0645\u0627\u06cc\u0634 \u062f\u0627\u062f\u0647 \u0634\u0648\u062f\u060c Username \u0645\u0648\u0631\u062f \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0648\u062c\u0648\u062f \u0646\u062f\u0627\u0631\u062f \u06cc\u0627 \u0627\u0634\u062a\u0628\u0627\u0647 \u0648\u0627\u0631\u062f \u0634\u062f\u0647 \u0627\u0633\u062a.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u062a\u06a9\u0631\u0627\u0631 \u062a\u0639\u062f\u0627\u062f \u0632\u06cc\u0627\u062f\u06cc \u0627\u0632 \u0627\u06cc\u0646 Event\u0647\u0627 \u0628\u0627 Username\u0647\u0627\u06cc \u0645\u062e\u062a\u0644\u0641 \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u062f \u0627\u0631\u0632\u0634 \u0628\u0631\u0631\u0633\u06cc \u0627\u0645\u0646\u06cc\u062a\u06cc \u062f\u0627\u0634\u062a\u0647 \u0628\u0627\u0634\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Account \u0642\u0641\u0644 \u0634\u062f\u0647 \u0627\u0633\u062a<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u06af\u0631:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Status: 0xC0000234\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0645\u0634\u0627\u0647\u062f\u0647 \u0634\u0648\u062f\u060c Account Lock \u0634\u062f\u0647 \u0627\u0633\u062a.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u062f\u0631 \u0627\u06cc\u0646 \u0634\u0631\u0627\u06cc\u0637 Event \u062f\u06cc\u06af\u0631\u06cc \u06a9\u0647 \u0628\u0627\u06cc\u062f \u0628\u0631\u0631\u0633\u06cc \u0634\u0648\u062f:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>4740\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u0633\u062a.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0639\u0646\u0648\u0627\u0646:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>A user account was locked out.\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Event <code>4740<\/code> \u0627\u0637\u0644\u0627\u0639\u0627\u062a\u06cc \u0645\u0627\u0646\u0646\u062f Account Name \u0648 <code>Caller Computer Name<\/code> \u0631\u0627 \u0646\u0645\u0627\u06cc\u0634 \u0645\u06cc\u200c\u062f\u0647\u062f \u06a9\u0647 \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u062f \u062f\u0631 \u067e\u06cc\u062f\u0627 \u06a9\u0631\u062f\u0646 \u0633\u06cc\u0633\u062a\u0645 \u0639\u0627\u0645\u0644 Lockout \u0645\u0641\u06cc\u062f \u0628\u0627\u0634\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0628\u0631\u0631\u0633\u06cc \u0647\u0645\u200c\u0632\u0645\u0627\u0646 Failed Login \u0648 Lockout<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u062f\u0631:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Filter Current Log\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0645\u0642\u062f\u0627\u0631 \u0632\u06cc\u0631 \u0631\u0627 \u0648\u0627\u0631\u062f \u06a9\u0646\u06cc\u062f:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>4625,4740\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u06cc\u0646 \u0631\u0648\u0634 \u06a9\u0645\u06a9 \u0645\u06cc\u200c\u06a9\u0646\u062f Login Failure\u0647\u0627\u06cc \u0642\u0628\u0644 \u0627\u0632 Account Lockout \u0631\u0627 \u062f\u0631 \u06a9\u0646\u0627\u0631 Event \u0645\u0631\u0628\u0648\u0637 \u0628\u0647 Lock \u0634\u062f\u0646 Account \u0645\u0634\u0627\u0647\u062f\u0647 \u06a9\u0646\u06cc\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u067e\u06cc\u062f\u0627 \u06a9\u0631\u062f\u0646 Brute Force \u0627\u062d\u062a\u0645\u0627\u0644\u06cc<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0641\u0631\u0636 \u06a9\u0646\u06cc\u062f \u062f\u0631 \u0686\u0646\u062f \u062f\u0642\u06cc\u0642\u0647 Event\u0647\u0627\u06cc \u0632\u06cc\u0631 \u062b\u0628\u062a \u0634\u062f\u0647\u200c\u0627\u0646\u062f:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>4625 - Administrator - 203.0.113.25\n4625 - Administrator - 203.0.113.25\n4625 - Administrator - 203.0.113.25\n4625 - Administrator - 203.0.113.25\n4625 - Administrator - 203.0.113.25\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u06af\u0631:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Username \u06cc\u06a9\u0633\u0627\u0646 \u0628\u0627\u0634\u062f<\/li>\n\n\n\n<li>Source IP \u06cc\u06a9\u0633\u0627\u0646 \u0628\u0627\u0634\u062f<\/li>\n\n\n\n<li>Login\u0647\u0627 \u062f\u0631 \u0645\u062f\u062a \u06a9\u0648\u062a\u0627\u0647 \u0631\u062e \u062f\u0627\u062f\u0647 \u0628\u0627\u0634\u0646\u062f<\/li>\n\n\n\n<li>Logon Type \u0628\u0631\u0627\u0628\u0631 <code>10<\/code> \u0628\u0627\u0634\u062f<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">\u0645\u0645\u06a9\u0646 \u0627\u0633\u062a \u0628\u0627 \u062a\u0644\u0627\u0634 \u0645\u06a9\u0631\u0631 RDP Login \u0631\u0648\u0628\u0647\u200c\u0631\u0648 \u0628\u0627\u0634\u06cc\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u0645\u0627 \u0641\u0642\u0637 \u0628\u0631\u0627\u0633\u0627\u0633 \u0648\u062c\u0648\u062f \u0686\u0646\u062f Event <code>4625<\/code> \u0646\u0628\u0627\u06cc\u062f \u0646\u062a\u06cc\u062c\u0647 \u0642\u0637\u0639\u06cc \u062f\u0631\u0628\u0627\u0631\u0647 \u062d\u0645\u0644\u0647 \u06af\u0631\u0641\u062a\u0647 \u0634\u0648\u062f\u061b Service\u060c Scheduled Task\u060c Credential \u0630\u062e\u06cc\u0631\u0647\u200c\u0634\u062f\u0647 \u06cc\u0627 Application \u062f\u0627\u0631\u0627\u06cc Password \u0642\u062f\u06cc\u0645\u06cc \u0646\u06cc\u0632 \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u062f \u0686\u0646\u06cc\u0646 Event\u0647\u0627\u06cc\u06cc \u0627\u06cc\u062c\u0627\u062f \u06a9\u0646\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u067e\u06cc\u062f\u0627 \u06a9\u0631\u062f\u0646 IP\u0647\u0627\u06cc\u06cc \u0628\u0627 \u0628\u06cc\u0634\u062a\u0631\u06cc\u0646 Failed Login<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">PowerShell \u0631\u0627 \u0628\u0627 \u062f\u0633\u062a\u0631\u0633\u06cc Administrator \u0628\u0627\u0632 \u06a9\u0646\u06cc\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u062f\u0633\u062a\u0648\u0631 \u0632\u06cc\u0631 Event\u0647\u0627\u06cc <code>4625<\/code> \u0645\u0631\u0628\u0648\u0637 \u0628\u0647 24 \u0633\u0627\u0639\u062a \u0627\u062e\u06cc\u0631 \u0631\u0627 \u0645\u06cc\u200c\u062e\u0648\u0627\u0646\u062f \u0648 Source IP\u0647\u0627 \u0631\u0627 \u0634\u0645\u0627\u0631\u0634 \u0645\u06cc\u200c\u06a9\u0646\u062f:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>$events = Get-WinEvent -FilterHashtable @{\n    LogName   = 'Security'\n    Id        = 4625\n    StartTime = (Get-Date).AddHours(-24)\n}\n\n$events | ForEach-Object {\n    $xml = &#91;xml]$_.ToXml()\n    $data = @{}\n\n    foreach ($item in $xml.Event.EventData.Data) {\n        $data&#91;$item.Name] = $item.'#text'\n    }\n\n    &#91;PSCustomObject]@{\n        TimeCreated = $_.TimeCreated\n        UserName    = $data&#91;'TargetUserName']\n        LogonType   = $data&#91;'LogonType']\n        SourceIP    = $data&#91;'IpAddress']\n        Status      = $data&#91;'Status']\n        SubStatus   = $data&#91;'SubStatus']\n    }\n} | Group-Object SourceIP |\nSort-Object Count -Descending |\nSelect-Object Count, Name\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u06cc\u0646 \u062e\u0631\u0648\u062c\u06cc \u0645\u0634\u062e\u0635 \u0645\u06cc\u200c\u06a9\u0646\u062f \u06a9\u062f\u0627\u0645 IP \u0628\u06cc\u0634\u062a\u0631\u06cc\u0646 Failed Login \u0631\u0627 \u0627\u06cc\u062c\u0627\u062f \u06a9\u0631\u062f\u0647 \u0627\u0633\u062a.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0645\u0634\u0627\u0647\u062f\u0647 \u062c\u0632\u0626\u06cc\u0627\u062a Failed Login \u0628\u0627 PowerShell<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc \u0646\u0645\u0627\u06cc\u0634 Username\u060c IP\u060c Logon Type \u0648 Status:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-WinEvent -FilterHashtable @{\n    LogName   = 'Security'\n    Id        = 4625\n    StartTime = (Get-Date).AddHours(-24)\n} | ForEach-Object {\n    $xml = &#91;xml]$_.ToXml()\n    $data = @{}\n\n    foreach ($item in $xml.Event.EventData.Data) {\n        $data&#91;$item.Name] = $item.'#text'\n    }\n\n    &#91;PSCustomObject]@{\n        TimeCreated = $_.TimeCreated\n        UserName    = $data&#91;'TargetUserName']\n        Domain      = $data&#91;'TargetDomainName']\n        LogonType   = $data&#91;'LogonType']\n        SourceIP    = $data&#91;'IpAddress']\n        Workstation = $data&#91;'WorkstationName']\n        Status      = $data&#91;'Status']\n        SubStatus   = $data&#91;'SubStatus']\n    }\n} | Format-Table -AutoSize\n<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0646\u0645\u0627\u06cc\u0634 \u0641\u0642\u0637 Failed RDP Login\u0647\u0627<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc RDP \u0628\u0627\u06cc\u062f Logon Type \u0628\u0631\u0627\u0628\u0631 <code>10<\/code> \u0628\u0627\u0634\u062f.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-WinEvent -FilterHashtable @{\n    LogName   = 'Security'\n    Id        = 4625\n    StartTime = (Get-Date).AddHours(-24)\n} | ForEach-Object {\n    $xml = &#91;xml]$_.ToXml()\n    $data = @{}\n\n    foreach ($item in $xml.Event.EventData.Data) {\n        $data&#91;$item.Name] = $item.'#text'\n    }\n\n    if ($data&#91;'LogonType'] -eq '10') {\n        &#91;PSCustomObject]@{\n            TimeCreated = $_.TimeCreated\n            UserName    = $data&#91;'TargetUserName']\n            SourceIP    = $data&#91;'IpAddress']\n            Status      = $data&#91;'Status']\n            SubStatus   = $data&#91;'SubStatus']\n        }\n    }\n} | Format-Table -AutoSize\n<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0645\u0634\u0627\u0647\u062f\u0647 \u0622\u062e\u0631\u06cc\u0646 50 Failed Login<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc \u0628\u0631\u0631\u0633\u06cc \u0633\u0631\u06cc\u0639:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-WinEvent -FilterHashtable @{\n    LogName = 'Security'\n    Id      = 4625\n} -MaxEvents 50 |\nSelect-Object TimeCreated, Id, Message |\nFormat-List\n<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Failed Login\u0647\u0627\u06cc \u06cc\u06a9 \u0633\u0627\u0639\u062a \u0627\u062e\u06cc\u0631<\/h1>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-WinEvent -FilterHashtable @{\n    LogName   = 'Security'\n    Id        = 4625\n    StartTime = (Get-Date).AddHours(-1)\n}\n<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Failed Login\u0647\u0627\u06cc 7 \u0631\u0648\u0632 \u0627\u062e\u06cc\u0631<\/h1>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-WinEvent -FilterHashtable @{\n    LogName   = 'Security'\n    Id        = 4625\n    StartTime = (Get-Date).AddDays(-7)\n}\n<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u067e\u06cc\u062f\u0627 \u06a9\u0631\u062f\u0646 Login\u0647\u0627\u06cc \u06cc\u06a9 Username \u0645\u0634\u062e\u0635<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc \u0645\u062b\u0627\u0644:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Administrator\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u06cc\u062f \u062e\u0631\u0648\u062c\u06cc Event\u0647\u0627 \u0631\u0627 Parse \u06a9\u0631\u062f\u0647 \u0648 \u0641\u0642\u0637 \u0647\u0645\u0627\u0646 Account \u0631\u0627 \u0646\u0645\u0627\u06cc\u0634 \u062f\u0647\u06cc\u062f:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-WinEvent -FilterHashtable @{\n    LogName   = 'Security'\n    Id        = 4625\n    StartTime = (Get-Date).AddDays(-1)\n} | Where-Object {\n    $_.Message -match 'Administrator'\n} | Select-Object TimeCreated, Id, Message\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc \u0628\u0631\u0631\u0633\u06cc \u062f\u0642\u06cc\u0642 \u0648 \u062e\u0648\u062f\u06a9\u0627\u0631 \u062a\u0639\u062f\u0627\u062f \u0632\u06cc\u0627\u062f Event\u0647\u0627\u060c \u0631\u0648\u0634 XML \u06a9\u0647 \u062f\u0631 \u0628\u062e\u0634\u200c\u0647\u0627\u06cc \u0642\u0628\u0644 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0634\u062f \u0642\u0627\u0628\u0644 \u0627\u0639\u062a\u0645\u0627\u062f\u062a\u0631 \u0627\u0632 \u062c\u0633\u062a\u062c\u0648\u06cc \u0645\u062a\u0646 Message \u0627\u0633\u062a.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0628\u0631\u0631\u0633\u06cc \u0628\u0627 wevtutil<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0622\u062e\u0631\u06cc\u0646 20 Failed Login:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>wevtutil qe Security \/q:\"*&#91;System&#91;(EventID=4625)]]\" \/c:20 \/rd:true \/f:text\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc \u0646\u0645\u0627\u06cc\u0634 Event\u0647\u0627 \u0627\u0632 \u062c\u062f\u06cc\u062f\u062a\u0631\u06cc\u0646 \u0628\u0647 \u0642\u062f\u06cc\u0645\u06cc\u200c\u062a\u0631\u06cc\u0646:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>\/rd:true\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0634\u062f\u0647 \u0627\u0633\u062a.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0627\u06af\u0631 Event 4625 \u062b\u0628\u062a \u0646\u0645\u06cc\u200c\u0634\u0648\u062f<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u062b\u0628\u062a \u0627\u06cc\u0646 Event \u0628\u0647 Audit Policy \u0645\u0631\u0628\u0648\u0637 \u0628\u0647 Logon \u0648\u0627\u0628\u0633\u062a\u0647 \u0627\u0633\u062a.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0648\u0636\u0639\u06cc\u062a Audit Policy \u0631\u0627 \u0628\u0631\u0631\u0633\u06cc \u06a9\u0646\u06cc\u062f:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>auditpol \/get \/subcategory:\"Logon\"\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u062e\u0631\u0648\u062c\u06cc \u0645\u0646\u0627\u0633\u0628 \u0628\u0631\u0627\u06cc \u0628\u0631\u0631\u0633\u06cc Login\u0647\u0627\u06cc \u0645\u0648\u0641\u0642 \u0648 \u0646\u0627\u0645\u0648\u0641\u0642 \u0645\u0639\u0645\u0648\u0644\u0627\u064b \u0628\u0627\u06cc\u062f \u0634\u0627\u0645\u0644:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Success and Failure\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0627\u0634\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0645\u0633\u06cc\u0631 Audit Policy<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u0632 GUI:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>secpol.msc\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0633\u067e\u0633:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Security Settings\nAdvanced Audit Policy Configuration\nSystem Audit Policies\nLogon\/Logoff\nAudit Logon\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0631\u0627 \u0628\u0627\u0632 \u06a9\u0646\u06cc\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc \u062b\u0628\u062a Failed Login \u0628\u0627\u06cc\u062f:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Failure\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0641\u0639\u0627\u0644 \u0628\u0627\u0634\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u062f\u0631 Domain Environment \u0645\u0645\u06a9\u0646 \u0627\u0633\u062a \u0627\u06cc\u0646 Policy \u0627\u0632 \u0637\u0631\u06cc\u0642 Group Policy \u0627\u0639\u0645\u0627\u0644 \u0634\u0648\u062f\u061b \u0628\u0646\u0627\u0628\u0631\u0627\u06cc\u0646 Local Policy \u0631\u0627 \u0628\u062f\u0648\u0646 \u0628\u0631\u0631\u0633\u06cc GPO \u062a\u063a\u06cc\u06cc\u0631 \u0646\u062f\u0647\u06cc\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Failed Login \u062f\u0631 Active Directory<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u062f\u0631 \u0645\u062d\u06cc\u0637 Domain \u0641\u0642\u0637 Event <code>4625<\/code> \u0631\u0648\u06cc Member Server \u0631\u0627 \u0628\u0631\u0631\u0633\u06cc \u0646\u06a9\u0646\u06cc\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0646\u0648\u0639 Authentication \u0646\u06cc\u0632 \u0627\u0647\u0645\u06cc\u062a \u062f\u0627\u0631\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc NTLM\u060c Event:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>4776\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u062f \u0631\u0648\u06cc \u0633\u06cc\u0633\u062a\u0645\u06cc \u06a9\u0647 \u0628\u0631\u0627\u06cc Credential\u0647\u0627 Authoritative \u0627\u0633\u062a \u062b\u0628\u062a \u0634\u0648\u062f. \u0628\u0631\u0627\u06cc Domain Account \u0627\u06cc\u0646 \u0633\u06cc\u0633\u062a\u0645 \u0645\u0639\u0645\u0648\u0644\u0627\u064b Domain Controller \u0627\u0633\u062a.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc Kerberos Pre-Authentication Failure \u0646\u06cc\u0632 Event:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>4771\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0631\u0648\u06cc Domain Controller \u062b\u0628\u062a \u0645\u06cc\u200c\u0634\u0648\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0646\u0627\u0628\u0631\u0627\u06cc\u0646 \u062f\u0631 Active Directory \u0645\u0645\u06a9\u0646 \u0627\u0633\u062a \u0644\u0627\u0632\u0645 \u0628\u0627\u0634\u062f \u0627\u06cc\u0646 Event\u0647\u0627 \u0631\u0627 \u0646\u06cc\u0632 \u0628\u0631\u0631\u0633\u06cc \u06a9\u0646\u06cc\u062f:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>4625\n4740\n4771\n4776\n<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Event ID 4771<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">Event:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>4771\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0647 \u0645\u0639\u0646\u06cc:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Kerberos pre-authentication failed\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u0633\u062a.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u06cc\u0646 Event \u0641\u0642\u0637 \u0631\u0648\u06cc Domain Controller \u0627\u06cc\u062c\u0627\u062f \u0645\u06cc\u200c\u0634\u0648\u062f \u0648 \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u062f \u062f\u0631 \u0645\u0648\u0627\u0631\u062f\u06cc \u0645\u0627\u0646\u0646\u062f Password \u0627\u0634\u062a\u0628\u0627\u0647 \u06cc\u0627 \u0645\u0634\u06a9\u0644\u0627\u062a Kerberos \u0645\u0634\u0627\u0647\u062f\u0647 \u0634\u0648\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Event ID 4776<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">Event:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>4776\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc Credential Validation \u0645\u0628\u062a\u0646\u06cc \u0628\u0631 NTLM \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0645\u06cc\u200c\u0634\u0648\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc Domain Account\u060c Event \u0631\u0648\u06cc Domain Controller \u062b\u0628\u062a \u0645\u06cc\u200c\u0634\u0648\u062f\u061b \u0628\u0631\u0627\u06cc Local Account \u0631\u0648\u06cc \u0647\u0645\u0627\u0646 \u0633\u06cc\u0633\u062a\u0645\u06cc \u06a9\u0647 Account \u0631\u0627 \u0646\u06af\u0647\u062f\u0627\u0631\u06cc \u0645\u06cc\u200c\u06a9\u0646\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u062a\u0641\u0627\u0648\u062a Event\u0647\u0627\u06cc \u0645\u0647\u0645<\/h1>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><thead><tr><th class=\"has-text-align-center\" data-align=\"center\">Event ID<\/th><th class=\"has-text-align-center\" data-align=\"center\">\u06a9\u0627\u0631\u0628\u0631\u062f<\/th><\/tr><\/thead><tbody><tr><td class=\"has-text-align-center\" data-align=\"center\"><code>4625<\/code><\/td><td class=\"has-text-align-center\" data-align=\"center\">Failed Logon<\/td><\/tr><tr><td class=\"has-text-align-center\" data-align=\"center\"><code>4740<\/code><\/td><td class=\"has-text-align-center\" data-align=\"center\">Account Lockout<\/td><\/tr><tr><td class=\"has-text-align-center\" data-align=\"center\"><code>4771<\/code><\/td><td class=\"has-text-align-center\" data-align=\"center\">Kerberos Pre-Authentication Failure<\/td><\/tr><tr><td class=\"has-text-align-center\" data-align=\"center\"><code>4776<\/code><\/td><td class=\"has-text-align-center\" data-align=\"center\">NTLM Credential Validation<\/td><\/tr><tr><td class=\"has-text-align-center\" data-align=\"center\"><code>4624<\/code><\/td><td class=\"has-text-align-center\" data-align=\"center\">Successful Logon<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">\u062f\u0631 \u0628\u06cc\u0634\u062a\u0631 \u0633\u0646\u0627\u0631\u06cc\u0648\u0647\u0627\u06cc Windows Server \u0645\u0633\u062a\u0642\u0644\u060c \u0646\u0642\u0637\u0647 \u0634\u0631\u0648\u0639:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>4625\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u0633\u062a.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0628\u0631\u0631\u0633\u06cc Failed Login \u0648 Login \u0645\u0648\u0641\u0642 \u0628\u0639\u062f \u0627\u0632 \u0622\u0646<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0633\u0646\u0627\u0631\u06cc\u0648\u06cc \u0632\u06cc\u0631 \u0627\u0647\u0645\u06cc\u062a \u0628\u06cc\u0634\u062a\u0631\u06cc \u062f\u0627\u0631\u062f:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>4625\n4625\n4625\n4625\n4624\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0645\u0645\u06a9\u0646 \u0627\u0633\u062a \u0686\u0646\u062f Failed Login \u0648 \u0633\u067e\u0633 \u06cc\u06a9 Successful Login \u0631\u062e \u062f\u0627\u062f\u0647 \u0628\u0627\u0634\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u062f\u0631 \u0686\u0646\u06cc\u0646 \u0634\u0631\u0627\u06cc\u0637\u06cc \u0628\u0627\u06cc\u062f \u0645\u0648\u0627\u0631\u062f \u0632\u06cc\u0631 \u0631\u0627 \u0628\u06cc\u0646 Event\u0647\u0627 \u0645\u0642\u0627\u06cc\u0633\u0647 \u06a9\u0646\u06cc\u062f:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Account Name\nSource IP\nLogon Type\nTime Created\nAuthentication Package\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u06af\u0631 Login \u0645\u0648\u0641\u0642 \u0627\u0632 \u0647\u0645\u0627\u0646 IP \u0648 \u0647\u0645\u0627\u0646 Username \u0628\u0639\u062f \u0627\u0632 \u062a\u0639\u062f\u0627\u062f \u0632\u06cc\u0627\u062f\u06cc Failure \u0627\u0646\u062c\u0627\u0645 \u0634\u062f\u0647 \u0627\u0633\u062a\u060c \u0628\u0631\u0631\u0633\u06cc \u0628\u06cc\u0634\u062a\u0631\u06cc \u0644\u0627\u0632\u0645 \u0627\u0633\u062a.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Export \u06af\u0631\u0641\u062a\u0646 \u0627\u0632 Security Log<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0642\u0628\u0644 \u0627\u0632 \u0627\u0639\u0645\u0627\u0644 \u062a\u063a\u06cc\u06cc\u0631\u0627\u062a \u0645\u0647\u0645 \u06cc\u0627 \u0628\u0631\u0631\u0633\u06cc Incident \u0628\u0647\u062a\u0631 \u0627\u0633\u062a Security Log \u0631\u0627 \u0630\u062e\u06cc\u0631\u0647 \u06a9\u0646\u06cc\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0631\u0648\u06cc:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Security\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Right Click \u06a9\u0631\u062f\u0647 \u0648:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Save All Events As...\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0631\u0627 \u0627\u0646\u062a\u062e\u0627\u0628 \u06a9\u0646\u06cc\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0641\u0631\u0645\u062a:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>.evtx\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0631\u0627 \u0627\u0646\u062a\u062e\u0627\u0628 \u06a9\u0646\u06cc\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc \u0645\u062b\u0627\u0644:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Security-Failed-Logins.evtx\n<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Export \u0628\u0627 Command Line<\/h1>\n\n\n\n<pre class=\"wp-block-code\"><code>wevtutil epl Security C:\\EventLogs\\Security.evtx\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u062f\u0631 \u0635\u0648\u0631\u062a \u0646\u0628\u0648\u062f Folder:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>New-Item -ItemType Directory -Path C:\\EventLogs -Force\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0631\u0627 \u0627\u0628\u062a\u062f\u0627 \u0627\u062c\u0631\u0627 \u06a9\u0646\u06cc\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0647\u0646\u06af\u0627\u0645 \u0645\u0634\u0627\u0647\u062f\u0647 Login\u0647\u0627\u06cc \u0645\u0634\u06a9\u0648\u06a9 \u0686\u0647 \u0645\u0648\u0627\u0631\u062f\u06cc \u0631\u0627 \u0628\u0631\u0631\u0633\u06cc \u06a9\u0646\u06cc\u0645\u061f<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u06af\u0631 Failed Login\u0647\u0627\u06cc \u0645\u062a\u0639\u062f\u062f \u0645\u0634\u0627\u0647\u062f\u0647 \u0634\u062f\u060c \u0645\u0648\u0627\u0631\u062f \u0632\u06cc\u0631 \u0631\u0627 \u06a9\u0646\u0627\u0631 \u06cc\u06a9\u062f\u06cc\u06af\u0631 \u0628\u0631\u0631\u0633\u06cc \u06a9\u0646\u06cc\u062f:<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><thead><tr><th class=\"has-text-align-center\" data-align=\"center\">\u0645\u0648\u0631\u062f<\/th><th class=\"has-text-align-center\" data-align=\"center\">\u0628\u0631\u0631\u0633\u06cc<\/th><\/tr><\/thead><tbody><tr><td class=\"has-text-align-center\" data-align=\"center\">Username<\/td><td class=\"has-text-align-center\" data-align=\"center\">\u06a9\u062f\u0627\u0645 Account \u0647\u062f\u0641 \u0628\u0648\u062f\u0647 \u0627\u0633\u062a<\/td><\/tr><tr><td class=\"has-text-align-center\" data-align=\"center\">Source IP<\/td><td class=\"has-text-align-center\" data-align=\"center\">\u062a\u0644\u0627\u0634 \u0627\u0632 \u06a9\u062c\u0627 \u0622\u0645\u062f\u0647 \u0627\u0633\u062a<\/td><\/tr><tr><td class=\"has-text-align-center\" data-align=\"center\">Logon Type<\/td><td class=\"has-text-align-center\" data-align=\"center\">RDP\u060c Network\u060c Service \u0648&#8230;<\/td><\/tr><tr><td class=\"has-text-align-center\" data-align=\"center\">\u062a\u0639\u062f\u0627\u062f Failure<\/td><td class=\"has-text-align-center\" data-align=\"center\">\u0686\u0646\u062f \u0628\u0627\u0631 \u062a\u06a9\u0631\u0627\u0631 \u0634\u062f\u0647 \u0627\u0633\u062a<\/td><\/tr><tr><td class=\"has-text-align-center\" data-align=\"center\">\u0641\u0627\u0635\u0644\u0647 \u0632\u0645\u0627\u0646\u06cc<\/td><td class=\"has-text-align-center\" data-align=\"center\">\u062f\u0631 \u0686\u0646\u062f \u062f\u0642\u06cc\u0642\u0647 \u06cc\u0627 \u0633\u0627\u0639\u062a<\/td><\/tr><tr><td class=\"has-text-align-center\" data-align=\"center\">Status<\/td><td class=\"has-text-align-center\" data-align=\"center\">\u0639\u0644\u062a Failure<\/td><\/tr><tr><td class=\"has-text-align-center\" data-align=\"center\">Sub Status<\/td><td class=\"has-text-align-center\" data-align=\"center\">\u062c\u0632\u0626\u06cc\u0627\u062a \u0628\u06cc\u0634\u062a\u0631<\/td><\/tr><tr><td class=\"has-text-align-center\" data-align=\"center\">Successful Login<\/td><td class=\"has-text-align-center\" data-align=\"center\">\u0622\u06cc\u0627 \u0628\u0639\u062f\u0627\u064b Login \u0645\u0648\u0641\u0642 \u0631\u062e \u062f\u0627\u062f\u0647<\/td><\/tr><tr><td class=\"has-text-align-center\" data-align=\"center\">Account Lockout<\/td><td class=\"has-text-align-center\" data-align=\"center\">\u0622\u06cc\u0627 Event 4740 \u0627\u06cc\u062c\u0627\u062f \u0634\u062f\u0647<\/td><\/tr><tr><td class=\"has-text-align-center\" data-align=\"center\">Authentication<\/td><td class=\"has-text-align-center\" data-align=\"center\">Kerberos\u060c NTLM \u06cc\u0627 Negotiate<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0627\u0634\u062a\u0628\u0627\u0647 \u0631\u0627\u06cc\u062c: \u0647\u0631 Event 4625 \u062d\u0645\u0644\u0647 \u0646\u06cc\u0633\u062a<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">Event <code>4625<\/code> \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u062f \u0628\u0647 \u062f\u0644\u0627\u06cc\u0644 \u06a9\u0627\u0645\u0644\u0627\u064b \u0639\u0627\u062f\u06cc \u0646\u06cc\u0632 \u0627\u06cc\u062c\u0627\u062f \u0634\u0648\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc \u0645\u062b\u0627\u0644:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Old password in Windows Service\nScheduled Task with expired password\nMapped drive\nSaved credentials\nApplication service account\nRDP password typo\nDisabled account\nExpired account\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0646\u0627\u0628\u0631\u0627\u06cc\u0646 \u0628\u0627\u06cc\u062f \u062a\u0639\u062f\u0627\u062f Event\u0647\u0627\u060c Source IP\u060c Username\u060c Logon Type \u0648 \u0632\u0645\u0627\u0646 \u0631\u062e\u062f\u0627\u062f \u0631\u0627 \u06a9\u0646\u0627\u0631 \u0647\u0645 \u0628\u0631\u0631\u0633\u06cc \u06a9\u0646\u06cc\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0627\u0634\u062a\u0628\u0627\u0647 \u0631\u0627\u06cc\u062c: Block \u06a9\u0631\u062f\u0646 IP \u0628\u062f\u0648\u0646 \u0628\u0631\u0631\u0633\u06cc<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u06af\u0631 \u06cc\u06a9 IP \u062f\u0631 Event <code>4625<\/code> \u0645\u0634\u0627\u0647\u062f\u0647 \u0634\u062f\u060c \u0642\u0628\u0644 \u0627\u0632 Block \u06a9\u0631\u062f\u0646 \u0622\u0646 \u0645\u0634\u062e\u0635 \u06a9\u0646\u06cc\u062f:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Is the IP internal?\nIs it a VPN address?\nIs it a monitoring server?\nIs it a backup server?\nIs it a trusted administrator?\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Source IP \u0628\u0647\u200c\u062a\u0646\u0647\u0627\u06cc\u06cc \u0628\u0631\u0627\u06cc \u0646\u062a\u06cc\u062c\u0647\u200c\u06af\u06cc\u0631\u06cc \u06a9\u0627\u0641\u06cc \u0646\u06cc\u0633\u062a.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0686\u06a9\u200c\u0644\u06cc\u0633\u062a \u0628\u0631\u0631\u0633\u06cc Failed Login<\/h1>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><thead><tr><th class=\"has-text-align-center\" data-align=\"center\">\u0645\u0631\u062d\u0644\u0647<\/th><th class=\"has-text-align-center\" data-align=\"center\">\u0648\u0636\u0639\u06cc\u062a<\/th><\/tr><\/thead><tbody><tr><td class=\"has-text-align-center\" data-align=\"center\">Event Viewer \u0628\u0627\u0632 \u0634\u062f\u0647<\/td><td class=\"has-text-align-center\" data-align=\"center\">\u2713<\/td><\/tr><tr><td class=\"has-text-align-center\" data-align=\"center\">Windows Logs &gt; Security \u0628\u0627\u0632 \u0634\u062f\u0647<\/td><td class=\"has-text-align-center\" data-align=\"center\">\u2713<\/td><\/tr><tr><td class=\"has-text-align-center\" data-align=\"center\">Event ID 4625 \u0641\u06cc\u0644\u062a\u0631 \u0634\u062f\u0647<\/td><td class=\"has-text-align-center\" data-align=\"center\">\u2713<\/td><\/tr><tr><td class=\"has-text-align-center\" data-align=\"center\">\u0628\u0627\u0632\u0647 \u0632\u0645\u0627\u0646\u06cc \u0645\u0634\u062e\u0635 \u0634\u062f\u0647<\/td><td class=\"has-text-align-center\" data-align=\"center\">\u2713<\/td><\/tr><tr><td class=\"has-text-align-center\" data-align=\"center\">Account Name \u0628\u0631\u0631\u0633\u06cc \u0634\u062f\u0647<\/td><td class=\"has-text-align-center\" data-align=\"center\">\u2713<\/td><\/tr><tr><td class=\"has-text-align-center\" data-align=\"center\">Logon Type \u0628\u0631\u0631\u0633\u06cc \u0634\u062f\u0647<\/td><td class=\"has-text-align-center\" data-align=\"center\">\u2713<\/td><\/tr><tr><td class=\"has-text-align-center\" data-align=\"center\">Source IP \u0628\u0631\u0631\u0633\u06cc \u0634\u062f\u0647<\/td><td class=\"has-text-align-center\" data-align=\"center\">\u2713<\/td><\/tr><tr><td class=\"has-text-align-center\" data-align=\"center\">Failure Reason \u0628\u0631\u0631\u0633\u06cc \u0634\u062f\u0647<\/td><td class=\"has-text-align-center\" data-align=\"center\">\u2713<\/td><\/tr><tr><td class=\"has-text-align-center\" data-align=\"center\">Status \u0628\u0631\u0631\u0633\u06cc \u0634\u062f\u0647<\/td><td class=\"has-text-align-center\" data-align=\"center\">\u2713<\/td><\/tr><tr><td class=\"has-text-align-center\" data-align=\"center\">Sub Status \u0628\u0631\u0631\u0633\u06cc \u0634\u062f\u0647<\/td><td class=\"has-text-align-center\" data-align=\"center\">\u2713<\/td><\/tr><tr><td class=\"has-text-align-center\" data-align=\"center\">Event 4740 \u0628\u0631\u0631\u0633\u06cc \u0634\u062f\u0647<\/td><td class=\"has-text-align-center\" data-align=\"center\">\u2713<\/td><\/tr><tr><td class=\"has-text-align-center\" data-align=\"center\">Login \u0645\u0648\u0641\u0642 \u0628\u0639\u062f \u0627\u0632 Failure \u0628\u0631\u0631\u0633\u06cc \u0634\u062f\u0647<\/td><td class=\"has-text-align-center\" data-align=\"center\">\u2713<\/td><\/tr><tr><td class=\"has-text-align-center\" data-align=\"center\">\u062f\u0631 Domain\u060c Event\u0647\u0627\u06cc 4771 \u0648 4776 \u0628\u0631\u0631\u0633\u06cc \u0634\u062f\u0647<\/td><td class=\"has-text-align-center\" data-align=\"center\">\u2713<\/td><\/tr><tr><td class=\"has-text-align-center\" data-align=\"center\">\u062f\u0631 \u0635\u0648\u0631\u062a \u0646\u06cc\u0627\u0632 EVTX Export \u06af\u0631\u0641\u062a\u0647 \u0634\u062f\u0647<\/td><td class=\"has-text-align-center\" data-align=\"center\">\u2713<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0645\u0637\u0627\u0644\u0639\u0627\u062a \u0628\u06cc\u0634\u062a\u0631<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0645\u0633\u062a\u0646\u062f \u0631\u0633\u0645\u06cc Microsoft \u062f\u0631\u0628\u0627\u0631\u0647 Event ID 4625 \u0648 Failed Logon:<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/learn.microsoft.com\/en-us\/previous-versions\/windows\/it-pro\/windows-10\/security\/threat-protection\/auditing\/event-4625?utm_source=chatgpt.com\" target=\"_blank\" rel=\"noopener\">4625(F): An account failed to log on \u2014 Microsoft Learn<\/a><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0645\u0633\u062a\u0646\u062f \u0631\u0633\u0645\u06cc Microsoft \u062f\u0631\u0628\u0627\u0631\u0647 Account Lockout \u0648 Event ID 4740:<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/learn.microsoft.com\/en-us\/previous-versions\/windows\/it-pro\/windows-10\/security\/threat-protection\/auditing\/event-4740?utm_source=chatgpt.com\" target=\"_blank\" rel=\"noopener\">4740(S): A user account was locked out \u2014 Microsoft Learn<\/a><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0645\u0633\u062a\u0646\u062f \u0631\u0633\u0645\u06cc Microsoft \u062f\u0631\u0628\u0627\u0631\u0647 Kerberos Failure \u0648 Event ID 4771:<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/learn.microsoft.com\/en-us\/previous-versions\/windows\/it-pro\/windows-10\/security\/threat-protection\/auditing\/event-4771?utm_source=chatgpt.com\" target=\"_blank\" rel=\"noopener\">4771(F): Kerberos pre-authentication failed \u2014 Microsoft Learn<\/a><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0645\u0633\u062a\u0646\u062f \u0631\u0633\u0645\u06cc Microsoft \u062f\u0631\u0628\u0627\u0631\u0647 NTLM Credential Validation \u0648 Event ID 4776:<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/learn.microsoft.com\/en-us\/previous-versions\/windows\/it-pro\/windows-10\/security\/threat-protection\/auditing\/event-4776?utm_source=chatgpt.com\" target=\"_blank\" rel=\"noopener\">4776: Credential validation \u2014 Microsoft Learn<\/a><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0645\u0633\u062a\u0646\u062f \u0631\u0633\u0645\u06cc Microsoft \u062f\u0631\u0628\u0627\u0631\u0647 Get-WinEvent:<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/learn.microsoft.com\/en-us\/powershell\/module\/microsoft.powershell.diagnostics\/get-winevent?utm_source=chatgpt.com\" target=\"_blank\" rel=\"noopener\">Get-WinEvent \u2014 Microsoft Learn<\/a><\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u062c\u0645\u0639\u200c\u0628\u0646\u062f\u06cc<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc \u067e\u06cc\u062f\u0627 \u06a9\u0631\u062f\u0646 Login\u0647\u0627\u06cc \u0646\u0627\u0645\u0648\u0641\u0642 \u062f\u0631 <strong>Windows Server 2025<\/strong> \u0627\u0628\u062a\u062f\u0627 \u0645\u0633\u06cc\u0631 \u0632\u06cc\u0631 \u0631\u0627 \u0628\u0627\u0632 \u06a9\u0646\u06cc\u062f:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Event Viewer\nWindows Logs\nSecurity\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0648 \u0633\u067e\u0633 Event ID \u0632\u06cc\u0631 \u0631\u0627 Filter \u06a9\u0646\u06cc\u062f:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>4625\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc \u0647\u0631 Event \u0645\u0647\u0645\u200c\u062a\u0631\u06cc\u0646 \u0627\u0637\u0644\u0627\u0639\u0627\u062a \u0639\u0628\u0627\u0631\u062a\u200c\u0627\u0646\u062f \u0627\u0632:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Account Name\nLogon Type\nSource Network Address\nFailure Reason\nStatus\nSub Status\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc Failed RDP Login \u0645\u0639\u0645\u0648\u0644\u0627\u064b:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Logon Type: 10\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0645\u0634\u0627\u0647\u062f\u0647 \u0645\u06cc\u200c\u0634\u0648\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u06af\u0631 Account Lock \u0634\u062f\u0647 \u0627\u0633\u062a:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>4740\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0631\u0627 \u0646\u06cc\u0632 \u0628\u0631\u0631\u0633\u06cc \u06a9\u0646\u06cc\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u062f\u0631 \u0645\u062d\u06cc\u0637 Active Directory \u0646\u06cc\u0632 \u0645\u0645\u06a9\u0646 \u0627\u0633\u062a \u0628\u0631\u0631\u0633\u06cc \u0645\u0648\u0627\u0631\u062f \u0632\u06cc\u0631 \u0631\u0648\u06cc Domain Controller \u0644\u0627\u0632\u0645 \u0628\u0627\u0634\u062f:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>4771\n4776\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0648 \u0627\u06af\u0631 Login Failure\u0647\u0627\u06cc \u0645\u062a\u0639\u062f\u062f \u0627\u0632 \u06cc\u06a9 IP \u06cc\u0627 \u0628\u0631\u0627\u06cc \u06cc\u06a9 Account \u0645\u0634\u0627\u0647\u062f\u0647 \u0634\u062f\u060c Event\u0647\u0627\u06cc Successful Login \u0628\u0639\u062f \u0627\u0632 \u0622\u0646 \u0631\u0627 \u0646\u06cc\u0632 \u0628\u0631\u0631\u0633\u06cc \u06a9\u0646\u06cc\u062f \u062a\u0627 Timeline \u06a9\u0627\u0645\u0644 Authentication \u0645\u0634\u062e\u0635 \u0634\u0648\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0645\u0647\u0645\u200c\u062a\u0631 \u0627\u0632 \u062a\u0639\u062f\u0627\u062f Event\u0647\u0627\u06cc <code>4625<\/code>\u060c <strong>\u062a\u0631\u06a9\u06cc\u0628 Username\u060c Source IP\u060c Logon Type\u060c Status \u0648 \u0632\u0645\u0627\u0646 \u0631\u062e\u062f\u0627\u062f\u0647\u0627<\/strong> \u0627\u0633\u062a\u061b \u0632\u06cc\u0631\u0627 \u06cc\u06a9 Login Failure \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u062f \u0627\u0632 Password \u0627\u0634\u062a\u0628\u0627\u0647 \u0639\u0627\u062f\u06cc \u062a\u0627 \u06cc\u06a9 \u062a\u0644\u0627\u0634 \u062f\u0633\u062a\u0631\u0633\u06cc \u063a\u06cc\u0631\u0645\u062c\u0627\u0632 \u062f\u0644\u0627\u06cc\u0644 \u0645\u062a\u0641\u0627\u0648\u062a\u06cc \u062f\u0627\u0634\u062a\u0647 \u0628\u0627\u0634\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n","protected":false},"excerpt":{"rendered":"<p>\u0645\u0642\u062f\u0645\u0647 \u062f\u0631 Windows Server 2025 \u062a\u0644\u0627\u0634\u200c\u0647\u0627\u06cc \u0646\u0627\u0645\u0648\u0641\u0642 \u0628\u0631\u0627\u06cc \u0648\u0631\u0648\u062f \u06a9\u0627\u0631\u0628\u0631\u0627\u0646 \u062f\u0631 Security Log \u062b\u0628\u062a \u0645\u06cc\u200c\u0634\u0648\u0646\u062f. \u0645\u0647\u0645\u200c\u062a\u0631\u06cc\u0646 Event \u0628\u0631\u0627\u06cc \u0628\u0631\u0631\u0633\u06cc \u0627\u06cc\u0646 \u0645\u0648\u0636\u0648\u0639: \u0627\u0633\u062a. Event ID 4625 \u0632\u0645\u0627\u0646\u06cc \u062b\u0628\u062a \u0645\u06cc\u200c\u0634\u0648\u062f \u06a9\u0647 \u06cc\u06a9 Logon \u0646\u0627\u0645\u0648\u0641\u0642 \u0631\u062e \u062f\u0647\u062f \u0648 \u0645\u0639\u0645\u0648\u0644\u0627\u064b \u0627\u0637\u0644\u0627\u0639\u0627\u062a\u06cc \u0645\u0627\u0646\u0646\u062f Username\u060c Logon Type\u060c Source IP\u060c Workstation\u060c Failure Reason\u060c Status \u0648 Sub Status \u0631\u0627 \u062f\u0631 \u0627\u062e\u062a\u06cc\u0627\u0631 Administrator \u0642\u0631\u0627\u0631 [&hellip;]<\/p>\n","protected":false},"author":4,"featured_media":21824,"parent":17708,"menu_order":45,"comment_status":"open","ping_status":"closed","template":"","doc_tag":[],"class_list":["post-21820","docs","type-docs","status-publish","has-post-thumbnail","hentry"],"acf":[],"author_avatar":"https:\/\/maralhost.com\/kb\/wp-content\/litespeed\/avatar\/86d527e9d6c721b378b27e18daa8865e.jpg?ver=1790059220","author_name":"Fateme Moayed","_links":{"self":[{"href":"https:\/\/maralhost.com\/kb\/wp-json\/wp\/v2\/docs\/21820","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/maralhost.com\/kb\/wp-json\/wp\/v2\/docs"}],"about":[{"href":"https:\/\/maralhost.com\/kb\/wp-json\/wp\/v2\/types\/docs"}],"author":[{"embeddable":true,"href":"https:\/\/maralhost.com\/kb\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/maralhost.com\/kb\/wp-json\/wp\/v2\/comments?post=21820"}],"version-history":[{"count":3,"href":"https:\/\/maralhost.com\/kb\/wp-json\/wp\/v2\/docs\/21820\/revisions"}],"predecessor-version":[{"id":21826,"href":"https:\/\/maralhost.com\/kb\/wp-json\/wp\/v2\/docs\/21820\/revisions\/21826"}],"up":[{"embeddable":true,"href":"https:\/\/maralhost.com\/kb\/wp-json\/wp\/v2\/docs\/17708"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/maralhost.com\/kb\/wp-json\/wp\/v2\/media\/21824"}],"wp:attachment":[{"href":"https:\/\/maralhost.com\/kb\/wp-json\/wp\/v2\/media?parent=21820"}],"wp:term":[{"taxonomy":"doc_tag","embeddable":true,"href":"https:\/\/maralhost.com\/kb\/wp-json\/wp\/v2\/doc_tag?post=21820"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}