You will likely start with “Event 342 – The user name or password is incorrect” in the ADFS Admin logs – this is about as useless as it gets.
In my scenario, I was seeing about 1,500 of those events per minute. Needless to say, something was wrong but we had no idea what could possibly be trying to authenticate that much. Luckily, ADFS has some built-in auditing that can be of more use in situations like this. Start out by opening the ADFS Management Console and choose the option “Edit Federation Service Properties…” (it’s in the column on the right). Once in the properties screen, click on the “Events” tab. Here you should see 5 checkboxes – 2 of which are unchecked. Check those boxes (Success audits and Failure audits) and click OK.
Now that ADFS is setup for auditing, you need to tell the server to allow it. Head on over to the Local Security Policy of the ADFS server – this can be found from the Server Manager. Once here, drop down “Advanced Audit Policy Configuration” and then “System Audit Policies – Local Group Policy Object”. Locate the “Object Access” policy and then open the “Audit Application Generated” subcategory. Check the three boxes on this screen and then click OK.
You should now be all set to revisit your Event Viewer. Look into the Security events under the Windows Logs and you should now see events with ID 411 for “Classic Audit Failure” with the source as “AD FS Auditing”.
Go ahead and open one of those bad boys up…. Ahhhh finally some useful information! A quick look through will reveal the Client IP, which should be the machine sending the invalid authentication requests to ADFS.
Thank you for this article. This is the closest that I have ever come to tracking down brute force attacks against our Office 365/ADFS login infrastructure.ReplyDelete
My issue now is that the IP address shown in Event ID 411 is always an IP owned by Microsoft so it seems it's only seeing the forwarding server not the actual client.
Windows Server 2012 R2 (ADFS 18.104.22.168)
This is very awesome. Thanks a lot for sharing.ReplyDelete
Betway Review & Bonus » Up to €500 + 100 Free SpinsReplyDelete
Betway's mobile クイーンカジノ sports betting offers range from standard sports to futures. Read our in-depth review link 12bet of this brand and see if you can trust betway Betway for