Contact Us
Support
Partners
Downloads
Cayosoft®
Trials & Tools
Book a Demo
CTD-000124

Privileged AD user with failed logon attempts

Medium
Active Directory
Credential Access
v31

Signature Identity

CTD-000124
Threat ID
31
Version
IOA-IOC
Indicator Type

Threat Description

It is a general recommendation by Microsoft to monitor the actions of high-value domain accounts. As these accounts have high-level permissions in your Active Directory, it’s possible that a threat actor may attempt to log in using these credentials to gain access to valuable resources and data in your environment. Failed logon attempts may indicate threat activities and should be thoroughly investigated.

NOTE: Cayosoft Guardian defines privileged users in Active Directory as users with adminCount=1. By design Active Directory uses this attribute to protect members of administrative groups.

According to security best practices it is not recommended re-using admin accounts, instead these accounts must be de-provisioned. If an account has administrative permissions, it might also obtain access to other resources using these administrative permissions and keep this access even after it is removed from the administrative groups. Learn more about AdminSdHolder and SDProp – Microsoft Community Hub.

MITRE ATT&CK: Attack Tactics

Credential Access

D3FEND: Defend Tactics

Domain accounts monitoring

Remediation

Investigate activities of the privileged user using Change History in Cayosoft Guardian. Change account’s password if necessary.

Frequently Asked Questions

What does Privileged AD user with failed logon attempts mean?

Privileged AD user with failed logon attempts refers to a high-value domain account, identified by adminCount=1 in Active Directory, that has experienced one or more login failures. These accounts have elevated permissions and are often targeted by attackers attempting to access sensitive resources.

This finding is rated medium severity because it indicates potential unauthorized access attempts against high-value domain accounts. Although a single failed login attempt does not grant administrative control, repeated or coordinated attempts can increase the risk of successful compromise through exploitation of authentication mechanisms.

Attackers may use failed logon attempts as reconnaissance to identify privileged accounts and plan future attacks. If successful in gaining access, they could exploit these elevated permissions to move laterally within the environment or maintain persistence through Kerberos ticket manipulation.

Cayosoft Guardian detects Privileged AD user with failed logon attempts by continuously monitoring Active Directory for accounts with adminCount=1 experiencing login failures, utilizing the Windows Security Auditing mechanism to track authentication events.

Cayosoft Guardian helps reduce the risk by providing visibility into potential unauthorized access attempts, supporting investigation and response efforts, and assisting administrators in reviewing and changing passwords for affected privileged accounts.

Stop AD Threats As They Happen

Cayosoft Protector provides continuous monitoring and real-time alerts across your entire Microsoft Identity stack

Free Forever
Classification
Systems
Active Directory
Themes
Account protection
Attack Tactics
Credential Access
Defend Tactics
Domain accounts monitoring
Indicator Types
IOA IOC
Related Threats
CTD-000139
Kerberos Constrained Delegation: krbtgt Risks
Critical
CTD-000122
Active Directory Schema Update Permission Risks
Critical