Windows Events
Domain Controller Blocked Audit: Audit NTLM authentication to this domain controller
Event ID 8004
Microsoft-Windows-NTLM/Operational
Network security: Restrict NTLM: Audit NTLM authentication in this domain
Main fields
IP address
IP
Windows
IP
ELK
-
Computer name
Computer
Windows
Computer
ELK
winlog.computer_name
User name
UserName
Windows
User
ELK
winlog.event_data.UserName
Important field
Not selected
Fields
| Windows Raw | Windows | ELK |
|---|---|---|
| UserName | User | winlog.event_data.UserName |
| DomainName | Domain | winlog.event_data.DomainName |
| IP System field | IP System field | - |
| Computer System field | Computer System field | winlog.computer_name |
| ProcessPID System field | ProcessPID System field | winlog.process.pid |
| ThreadID System field | ThreadID System field | winlog.process.thread.id |
Sample Event
No Sample Event Provided.