Splunk® App for Windows Infrastructure (Legacy)

Splunk App for Windows Infrastructure Reference

On October 20, 2021, the Splunk App for Windows Infrastructure will reach its end of life. After this date, Splunk will no longer maintain or develop this product. The functionality in this app is migrating to a content pack in Data Integrations. Learn about the Content Pack for Windows Dashboards and Reports.

Failed Logons

Exch 30 adfailedlogons.png

The Failed Logons dashboard provides insight into recent failed attempts by users to log into your domain. Specific statistics include:

  • Failed logons over time.
  • Failed interactive logons by IP address.
  • Failed logons by reason (for example, expired password, locked account, or disabled account.)
  • Failed interactive logons by username.
  • Failed logons by logon type.
  • Users failing to logon from multiple IPs (for example, an active attempt to break into the network.)

How to use this page

This selection panel lets you filter results based on Forest, Site, Domain, and Server.

You can also control how much information the app displays by selecting the time range you desire in the time range picker on the upper right side of the dashboard.

Last modified on 30 November, 2016
User Record Changes   AD Anomalous Logons

This documentation applies to the following versions of Splunk® App for Windows Infrastructure (Legacy): 1.4.1, 1.4.2, 1.4.3, 1.4.4, 1.5.0, 1.5.1, 1.5.2, 2.0.0, 2.0.1, 2.0.2, 2.0.3, 2.0.4

Acrobat logo Download manual
Acrobat logo Download this page

Was this topic useful?







You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters