At a hotel, a front-desk Windows host records event 4740, an account lockout, after a burst of event 4625 failures from the guest VLAN. What do those events show?
Select an answer to reveal the explanation.
Short Explanation
A door that bolts after too many bad keys is a lockout, and these keys came from the guest hallway. You have event 4740 after a burst of 4625 failures from the guest VLAN. The trap is calling that a new service, a cleared audit log, or a scheduled task.
Full Explanation
Event 4625 is a failed logon and event 4740 is an account lockout. A burst of 4625 records from the guest VLAN followed by 4740 means The account locked after repeated failed logons that originated on the guest VLAN. A new service was installed on the front-desk host and registered with the service manager would be event 7045, which is not the pair in front of you. The security audit log was cleared, so later security events from this host are missing, would be event 1102, and a lockout record is the opposite of a log that was wiped before these events. A scheduled task was created on the front-desk host and then ran at the recorded time would be event 4698 for the creation, and neither 4625 nor 4740 is a task. Read 4625 as the failed attempts and 4740 as the lockout that followed, with the guest VLAN as the unusual source for a front-desk host. Exam caveat: a lockout can also be a forgotten password; the guest VLAN as the source is what makes the burst worth a hostile-logon review. Operational check: compare the 4625 source addresses with the front-desk network and talk to the account owner before you unlock the account.