Bad passwords logged in the DC Netlogon logs: for a specific account name: index=cim sourcetype=netlogon host=*dc* "0xC000006A" Logon_Account="*<accountname>” *** need the asterisk since the netlogon log usually puts the domain netbios name in front of the account name, for a specific account by source: index=cim sourcetype=netlogon host=*dc* "0xC000006A" Logon_Account="*<accountname>” *** same query as above because I did not find an easy way to get the bad password source. Anyone please help me
... View more