Certain groups of users are considered high risk these groups include people who possess escalated privileges
in the system.
Usually there are the administrators they have to be monitored with special care
with high risk groups events that are to be audited should include above all failed admin account logons
event 8:55
event 5:34 is extremely alarming certain services are run with specified user privileges special accounts
that are set up for the services Eskew or servers.
For example use a domain account called sequel server.
No one should log into this account if a user has successfully logged.
This probably means that our rescue server has been compromised.
Event 6 so one is an attempt to install a new system service.
We've now moved to the event types that if logged suggests that the security policy is flouted or even
that we've been attacked
event 5 3 1 is an attempt to log on to a locked account.
The feature that locks accounts is helpful but it should take more than five failed attempts for a lockout.
A user could have simply forgotten this password.
The Caps Lock key might be pressed or the keyboard layout has changed.
It's easy to accidentally press control plus shift forcing and account lockout after five failed logons
will only protected against a simple guessing of passwords.
Five attempts can be enough only for the weakest passwords.
You should in reality defend user accounts against the threat by telling users that passwords are secure
and crack proof.
If your users know the basic password handling rules you can lift the threshold to 15 or 50 failed log
on attempts.
There's an equally low risk that an attacker would be able to successfully determine a password in five
or 50 attempts.
And raising the limit will also relieve your I-T department workload by 30 percent
even 5:32 indicates a failed attempt to log in with a disabled account.
Disable the accounts or simply account templates.
There is for example a production department user account template when a new employee is hired in the
department.
It's enough to simply duplicate the template to have a well configured account templates have to be
disabled as they're not assigned to a specific person and are not monitored if the user attempts to
log into a template.
This suggests that he is trying to escalate privileges this event should be detected and noticed at
once.