GCFA · Question #326
John works as a Network Administrator for DigiNet Inc. He wants to investigate failed logon attempts to a network. He uses Log Parser to detail out the failed logons over a specific time frame. He use
The correct answer is D. 532. Windows legacy security Event ID 532 indicates a logon failure specifically because the user account has expired, distinguishing it from other logon failure codes.
Question
John works as a Network Administrator for DigiNet Inc. He wants to investigate failed logon attempts to a network. He uses Log Parser to detail out the failed logons over a specific time frame. He uses the following commands and query to list all failed logons on a specific date:
logparser.exe file:FailedLogons.sql -i:EVT -o:datagrid SELECT timegenerated AS LogonTime, extract_token(strings, 0, '|') AS UserName FROM Security WHERE EventID IN (529; 530; 531; 532; 533; 534; 535; 537; 539) AND to_string(timegenerated,'yyyy-MM-dd HH:mm:ss') like '2004-09%' After investigation, John concludes that two logon attempts were made by using an expired account. Which of the following EventID refers to this failed logon?
Options
- A529
- B534
- C531
- D532
How the community answered
(22 responses)- A9% (2)
- B5% (1)
- C5% (1)
- D82% (18)
Why each option
Windows legacy security Event ID 532 indicates a logon failure specifically because the user account has expired, distinguishing it from other logon failure codes.
Event ID 529 indicates logon failure due to an unknown username or bad password, not an expired account.
Event ID 534 indicates logon failure because the user was not granted the requested logon type (e.g., interactive vs. network), not because the account expired.
Event ID 531 indicates logon failure because the account is currently disabled, not because it has expired.
In Windows (XP/Server 2003 era) security event logging, Event ID 532 maps specifically to 'Logon failure - The specified user account has expired.' This is distinct from Event ID 535 which covers password expiration, making 532 the correct identifier for an expired account logon attempt.
Concept tested: Windows legacy security event ID for expired account
Source: https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2003/cc787532(v=ws.10)
Topics
Community Discussion
No community discussion yet for this question.