Audit Network Logon Denied

An audit log entry is written when the network logon request is denied.

struct ae_netlogdenied {
  unsigned short ae_nd_compname; /* offset */
  unsigned short ae_nd_username; /* offset */
  unsigned short ae_nd_reason;
  unsigned short ae_nd_subreason;
};

where:

• ae_nd_compname is an offset (from the beginning address of the ae_netlogdenied data structure) to an ASCIIZ string indicating the requester that established the session.

• ae_nd_username is an offset (from the beginning address of the ae_netlogdenied data structure) to an ASCIIZ string indicating the name of the user who initiated the session. If 0, ae_nd_username and ae_nd_compname are the same.

• ae_nd_reason is the reason for logon denial, as follows: ┌────────────────────┬───────┬─────────────────────────────────────────────────┐
  │ SYMBOLIC CONSTANT │ VALUE │ MEANING │
  ├────────────────────┼───────┼─────────────────────────────────────────────────┤
  │ AE_GENERAL │ 0 │ General access denied. │
  ├────────────────────┼───────┼─────────────────────────────────────────────────┤
  │ AE_BADPW │ 1 │ Incorrect password. │
  ├────────────────────┼───────┼─────────────────────────────────────────────────┤
  │ AE_ACCRESTRICT │ 4 │ Forced off by account system because of account │
  │ │ │ restriction, such as logon hours. │
  ├────────────────────┼───────┼─────────────────────────────────────────────────┤
  │ AE_UNDEFINEDUSER │ 9 │ User ID does not exist. │
  └────────────────────┴───────┴─────────────────────────────────────────────────┘
  

• ae_nd_subreason is the detail of the reason for denial. When nd_reason is AE_ACCRESTRICT, one of the following is true: ┌────────────────────┬───────┬─────────────────────────────────────────────────┐
  │ SYMBOLIC CONSTANT │ VALUE │ MEANING │
  ├────────────────────┼───────┼─────────────────────────────────────────────────┤
  │ AE_LIM_UNKNOWN │ 0 │ Unknown or unavailable. │
  ├────────────────────┼───────┼─────────────────────────────────────────────────┤
  │ AE_LIM_LOGONHOURS │ 1 │ Logon hours. │
  ├────────────────────┼───────┼─────────────────────────────────────────────────┤
  │ AE_LIM_EXPIRED │ 2 │ Account expired. │
  ├────────────────────┼───────┼─────────────────────────────────────────────────┤
  │ AE_LIM_INVAL_WKSTA │ 3 │ Requester ID not valid. │
  ├────────────────────┼───────┼─────────────────────────────────────────────────┤
  │ AE_LIM_DISABLED │ 4 │ Account disabled. │
  └────────────────────┴───────┴─────────────────────────────────────────────────┘
  

  Otherwise, this value is 0.