nerdexam
GIAC

GCFA · Question #326

John works as a Network Administrator for DigiNet Inc. He wants to investigate failed logon attempts to a network. He uses Log Parser to detail out the failed logons over a specific time frame. He use

The correct answer is D. 532. Windows legacy security Event ID 532 indicates a logon failure specifically because the user account has expired, distinguishing it from other logon failure codes.

Threat Hunting & Timeline Analysis

Question

John works as a Network Administrator for DigiNet Inc. He wants to investigate failed logon attempts to a network. He uses Log Parser to detail out the failed logons over a specific time frame. He uses the following commands and query to list all failed logons on a specific date:

logparser.exe file:FailedLogons.sql -i:EVT -o:datagrid SELECT timegenerated AS LogonTime, extract_token(strings, 0, '|') AS UserName FROM Security WHERE EventID IN (529; 530; 531; 532; 533; 534; 535; 537; 539) AND to_string(timegenerated,'yyyy-MM-dd HH:mm:ss') like '2004-09%' After investigation, John concludes that two logon attempts were made by using an expired account. Which of the following EventID refers to this failed logon?

Options

  • A529
  • B534
  • C531
  • D532

How the community answered

(22 responses)
  • A
    9% (2)
  • B
    5% (1)
  • C
    5% (1)
  • D
    82% (18)

Why each option

Windows legacy security Event ID 532 indicates a logon failure specifically because the user account has expired, distinguishing it from other logon failure codes.

A529

Event ID 529 indicates logon failure due to an unknown username or bad password, not an expired account.

B534

Event ID 534 indicates logon failure because the user was not granted the requested logon type (e.g., interactive vs. network), not because the account expired.

C531

Event ID 531 indicates logon failure because the account is currently disabled, not because it has expired.

D532Correct

In Windows (XP/Server 2003 era) security event logging, Event ID 532 maps specifically to 'Logon failure - The specified user account has expired.' This is distinct from Event ID 535 which covers password expiration, making 532 the correct identifier for an expired account logon attempt.

Concept tested: Windows legacy security event ID for expired account

Source: https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2003/cc787532(v=ws.10)

Topics

#Log Parser#Windows Event IDs#failed logon analysis#security event logs

Community Discussion

No community discussion yet for this question.

Full GCFA Practice