Not sure about no user but probably that's why it alerted as FAILURE, but here good details about this eventid (and others) https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=4673
Other informations were provided with alert ? Regards, On Mon, Dec 14, 2015 at 11:47 AM, <[email protected]> wrote: > I was wondering what the event: > WinEvtLog: Security: AUDIT_FAILURE(4673): > Microsoft-Windows-Security-Auditing: (no user) > > means. In the past it was determined to be a non-attack event in my > environment, but I wondering what it means. > > -- > > --- > You received this message because you are subscribed to the Google Groups > "ossec-list" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [email protected]. > For more options, visit https://groups.google.com/d/optout. > -- Rodrigo Montoro (Sp0oKeR) http://spookerlabs.blogspot.com http://www.twitter.com/spookerlabs http://www.linkedin.com/in/spooker -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
