How to analyze a log..

[myke]

I enabled auditing in my domain and started to gather data.
I focused more on Failure esp on account logon. Does
anybody know where I can get those explanation of those
values since I found it difficult to anaylyze.
Like for example
Pre-authentication type : 0x2
Failure Code : 0x18

What are all of this?

 

[Matjaz Ladava [MVP]]

Well www.eventid.net is the source to get information o various event id's.
Another one is http://support.microsoft.com


--
Regards

Matjaz Ladava
MVP Windows Server - Directory Services
(e-mail address removed), (e-mail address removed)

 

[Tomasz Onyszko]

I enabled auditing in my domain and started to gather data.
I focused more on Failure esp on account logon. Does
anybody know where I can get those explanation of those
values since I found it difficult to anaylyze.
Like for example
Pre-authentication type : 0x2
Failure Code : 0x18

Bad password in general

What are all of this?

I think this will help You a little
http://www.eventid.net/display.asp?eventid=675&eventno=62&source=Security&phase=1