Microsoft_authentication_package logon attempt

Feedback will be sent to Microsoft: By pressing the submit button, your feedback will be used to improve Microsoft products and services.

Privacy policy. Subcategory: Audit Credential Validation. This event occurs only on the computer that is authoritative for the provided credentials. For domain accounts, the domain controller is authoritative. For local accounts, the local computer is authoritative. It shows only the computer name Source Workstation from which the authentication attempt was performed authentication source. The main advantage of this event is that on domain controllers you can see all authentication attempts for domain accounts when NTLM authentication was used.

This event does not generate when a domain account logs on locally to a domain controller. Note For recommendations, see Security Monitoring Recommendations for this event. Note Authentication package is a DLL that encapsulates the authentication logic used to determine whether to permit a user to log on. Local Security Authority LSA authenticates a user logon by sending the request to an authentication package.

The authentication package then examines the logon information and either authenticates or rejects the user logon attempt. Authentication packages are contained in dynamic-link libraries. The Local Security Authority LSA loads authentication packages by using configuration information stored in the registry.

Loading multiple authentication packages permits the LSA to support multiple logon processes and multiple security protocols. Logon processes use authentication packages to analyze logon data. New logon processes are added to a system by adding a GINA to collect the required logon data and, if needed, by adding a new authentication package to analyze the data.

Security protocols are implemented by authentication packages. An authentication package analyzes logon data by following the rules and procedures set forth in a security protocol. When a user attempts an interactive logon, the LSA calls an authentication package to determine whether to permit the user to log on. If the logon data matches the stored credentials , the authentication package permits the logon to succeed.

After successfully authenticating a security principal's credentials, an authentication package is responsible for creating a new LSA logon session for the principal and allocating the logon identifier that uniquely identifies the logon session.

Time: It's like if the first authentication fails and then the account is recognized and it then works. Error Code 0xC means "The specified user does not exist". Is kiwiAccount a domain user account? I think there is something lost about the logon account in the first authentication such as the domain name. This can be beneficial to other community members reading the thread. Office Office Exchange Server. Not an IT pro? Windows Server TechCenter. Sign in.