LanSweeper Scan causes failed logon event logs on DCs

[Stephan_R]

Hi all,

since some time (i don't know exactly since when - maybe since the update to v10.2.4.0) LanSweeper is spamming failed logon events (4625) in our security event logs on all our domain controllers.

here is an example event (removed IPs / hostnames)

<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
 <System>
  <Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-a5ba-3e3b0328c30d}" /> 
  <EventID>4625</EventID> 
  <Version>0</Version> 
  <Level>0</Level> 
  <Task>12544</Task> 
  <Opcode>0</Opcode> 
  <Keywords>0x8010000000000000</Keywords> 
  <TimeCreated SystemTime="2022-11-22T15:16:54.207895700Z" /> 
  <EventRecordID>453580707</EventRecordID> 
  <Correlation /> 
  <Execution ProcessID="720" ThreadID="6748" /> 
  <Channel>Security</Channel> 
  <Computer>...</Computer> 
  <Security /> 
 </System>
 <EventData>
  <Data Name="SubjectUserSid">S-1-5-18</Data> 
  <Data Name="SubjectUserName">...</Data> 
  <Data Name="SubjectDomainName">...</Data> 
  <Data Name="SubjectLogonId">0x3e7</Data> 
  <Data Name="TargetUserSid">S-1-0-0</Data> 
  <Data Name="TargetUserName" /> 
  <Data Name="TargetDomainName" /> 
  <Data Name="Status">0xc000006d</Data> 
  <Data Name="FailureReason">%%2313</Data> 
  <Data Name="SubStatus">0xc0000064</Data> 
  <Data Name="LogonType">3</Data> 
  <Data Name="LogonProcessName">Schannel</Data> 
  <Data Name="AuthenticationPackageName">Kerberos</Data> 
  <Data Name="WorkstationName">...</Data> 
  <Data Name="TransmittedServices">-</Data> 
  <Data Name="LmPackageName">-</Data> 
  <Data Name="KeyLength">0</Data> 
  <Data Name="ProcessId">0x2d0</Data> 
  <Data Name="ProcessName">C:\Windows\System32\lsass.exe</Data> 
  <Data Name="IpAddress">...</Data> 
  <Data Name="IpPort">58937</Data> 
 </EventData>
</Event>

It looks like that this event comes up for every asset scan which was performed and it's always the same status "unknown username or password" for target user SID "S-1-0-0"

I already checked all of our windows credentials and the mapping in LanSweeper but they are fine and didn't changed at all (and also working for auditing our windows assets)
I think there is something else going wrong because of the strange target user SID.

Maybe someone know how to stop or fix these logon attamps from the LanSweeper scanning service or had the same issue?

Thanks a lot and kind Regards,
Stephan

[martinb1]

Hi Stephan, 

I see the same behaviour on my DCs after switching over to LDAPS. Did you ever find a solution for it? 

Additionally I can log these failed Kerberos authentication attempts from the Lansweeper server, which are showing a bit before the event you posted. You can see here, that an authentication attempt is made with the account name: "host" , looks like a broken variable to me. Of course this authentication attempt results in a user unknown response.

Regards,

Martin

[Stephan_R]

Hi Martin,

unfortunately I still have no solution for this issue, even the lansweeper support couldn't fix it after some troubleshooting. My support ticket was closed because it wasn't reproducable in the lab.
I still use lansweeper with a LDAP (non-secure) connection to workaround this issue.

Regards,
Stephan

[Stephan_R]

update: I contacted the lansweeper support and they figured out that the usage of LDAPS was the issue. Switching back to LDAP instead of LDAPS (in Scanning -> Scanning targets -> On-Premises Active Directory Scanning Options -> LDAP(S) ) fixed the issue for now.

They currently try to reproduce this issue on a lab to provide a fix

[Tim_N]

Stephan_R, I wonder if this was recently fixed with the update of 10.4.1.0. 

Lansweeper Changelog - Lansweeper.com

There's something similar listed there as LAN-14431. Try upgrading to this version and see if that helps you out. 

Please keep us posted how it goes.

[Stephan_R]

Hi Tim_N, thank you for the hint.

I've updated and tested with LDAPS again right now, but unfortunately I still have the same issue.

Kind Regards,
Stephan

[ErikT]

@Stephan_R, if the issue isn't fixed after upgrading, I would recommend reaching out to our support team again. 

[Stephan_R]

the issue couln't be reproduced in the test lab from Lansweeper support.
So this issue still persists in my environment, as soon as I endable LDAPS in LanSweeper

Any hints for troubleshooting or a Workaround (except switch to LDAP non-secure 😉 ) is welcome

Kind Regards,
Stephan