The user account and password are correct, but the logon attempt failed because it occurred outside the hours that the user is allowed to log on. This restriction is configured on the user’s domain account.
- The code in the Logon Type field specifies the logon method used. The following table explains the logon type code:
||A user logged on to this computer at the console.
||A user or computer logged on to this computer from the network.
||Batch logon type is used by batch servers, where processes might run on behalf of a user without the user’s direct intervention.
||A service was started by the Service Control Manager.
||This computer was unlocked.
||A user logged on to a network and the user password was passed to the authentication package in its unhashed (plain text) form. It is possible that the unhashed password was passed across the network, for example, when IIS performed basic authentication.
||A caller (process, thread, or program) cloned its current token and specified new credentials for outbound connections. The new logon session has the same local identity, but it uses different credentials for other network connections.
||A user logged on to this computer remotely using Terminal Services or a Remote Desktop connection.
||A user logged on to this computer with network credentials that were stored locally on the computer. The domain controller was not contacted to verify the credentials.
- The Authentication Package field values are specified in the following table:
|MSV1_0 and Microsoft_Authentication_Package_MV_1
||Both refer to the MSV1_0 authentication package in the NTLM SSP (Security Support provider), which supports the NTLMv2, NTLM, and LM authentication protocols and local SAM lookups.
||Refers to the Kerberos authentication package in the Kerberos SSP, which supports the Kerberos protocol.
- The Workstation name field specifies the NetBIOS name of the remote computer that originated the logon request. If no information is displayed in this field, either a Kerberos logon attempt failed because the ticket could not be decrypted, or a non-Windows NetBIOS implementation or utility did not supply the remote computer name in the logon request.
- The Caller fields specify the process that received the logon request.
- The Transited Services field specifies the services or programs in order through which the user’s credentials have been authenticated by using constrained delegation.
- The Source Network Address and Source Port fields specify the source IP address and source port number for the remote computer that sent the logon request.