Windows Server 2019 not recording failed logins (Event 4625)

[Burce Matute Gunes]

Hello all,I am using Windows Server 2019 on DCs and workstations. Event viewer is not recording RDP failed logins but I can see the successful logon. I made few changes to see the failed RDP logins;Workstation and DCsAudit credentials validation > failureAudit logon > success and failureOnly DCsAudit Kerberos Authentication Service > failureAudit Kerberos Service Ticket Operations> failureNow, I can see the error 4771-Audit Failure on just DC but there are no details about which workstation is getting failed login attempt.

Continue reading...