View source for HIDS 59222

= Description =

Windows has detected that a system has attempted to log into the Windows system remotely, and the account they have tried to use is either unknown to the system, or the password is incorrect. 

== Associated Windows Event IDs ==

*529
*530
*531
*532
*533
*534
*535
*536
*537
*539
*4625

== What you should do ==

This means that the logon failed to authenticate correctly.  If this event has occurred because of a bad password, or incorrect user name.  The platform will track this logon, and if multiple events occur will issue a higher level alert that a brute force attack may be occurring.