SF.net SVN: logwatch:[309] trunk/scripts/services/evtsecurity

Revision: 309
          http://sourceforge.net/p/logwatch/code/309
Author:   opoplawski
Date:     2016-01-29 23:40:54 +0000 (Fri, 29 Jan 2016)
Log Message:
-----------
[evtsecurity] Handle Kerberos account disabled messages

Modified Paths:
--------------
    trunk/scripts/services/evtsecurity

Modified: trunk/scripts/services/evtsecurity
===================================================================
--- trunk/scripts/services/evtsecurity	2016-01-06 22:50:05 UTC (rev 308)
+++ trunk/scripts/services/evtsecurity	2016-01-29 23:40:54 UTC (rev 309)
@@ -88,7 +88,10 @@
       } elsif ($EventID == 4771) {
          # Kerberos pre-authentication failed
          my ($Account,$Client,$FailureCode) = $ExpandedString =~ /Account Name:\s+(\S+)\s.*Client Address:\s+(\S+)\s.*Failure Code:\s+(\w+)/;
-         if ($FailureCode eq "0x18") {
+         if ($FailureCode eq "0x12") {
+            #Clients credentials have been revoked      Account disabled, expired, locked out, logon hours.
+            $AccountLocked{"$Account $Client"}++;
+         } elsif ($FailureCode eq "0x18") {
             #Pre-authentication information was invalid - bad password
             $BadPasswords{"$Account $Client"}++;
          } elsif ($FailureCode eq "0x25") {

This was sent by the SourceForge.net collaborative development platform, the world's largest Open Source development site.


------------------------------------------------------------------------------
Site24x7 APM Insight: Get Deep Visibility into Application Performance
APM + Mobile APM + RUM: Monitor 3 App instances at just $35/Month
Monitor end-to-end web transactions and take corrective actions now
Troubleshoot faster and improve end-user experience. Signup Now!
http://pubads.g.doubleclick.net/gampad/clk?id=267308311&iu=/4140