I'm pulling the Failed Login events from Windows 2008 Domain Controller Servers, and have found many Status and Sub-Status values to which I can't relate a description.
The Status values are:
STATUS | DESCRIPTION |
---|---|
0XC0000234 | user is currently locked out |
0XC0000193 | account expiration |
0XC0000133 | clocks between DC and other computer too far out of sync |
0XC0000224 | user is required to change password at next logon |
0XC0000225 | evidently a bug in Windows and not a risk |
0XC000015B | The user has not been granted the requested logon type (aka logon right) at this machine |
0XC000006D | This is either due to a bad username or authentication information |
0XC000006E | Unknown user name or bad password. |
0XC00002EE | Failure Reason: An Error occurred during Logon |
0XC000005E | ? |
0XC00000DC | ? |
0XC0000192 | ? |
0XC0000413 | ? |
0XC000009A | ? |
The Sub Status Values are:
SUB_STATUS | DESCRIPTION |
---|---|
0XC000006D | This is either due to a bad username or authentication information |
0XC000006D | This is either due to a bad username or authentication information |
0XC000006E | Unknown user name or bad password. |
0XC000006E | Unknown user name or bad password. |
0XC0000193 | account expiration |
0XC000006E | Unknown user name or bad password. |
0XC000006D | This is either due to a bad username or authentication information |
0XC000006D | This is either due to a bad username or authentication information |
0XC000018C | ? |
0XC000005E | ? |
0XC00000DC | ? |
0XC0000224 | user is required to change password at next logon |
0XC0000192 | ? |
0XC0000413 | ? |
Can you please help me find a list with all the possible values and their description?
Thanks,
Eli