Carbon Black Cloud: The Auth_Failed_Logon_Count Field is Zero

[#1]

Environment

• Carbon Black Cloud Sensor: All Supported Versions
• Microsoft Windows: All Supported Versions

Symptoms

The "Enable auth event collection" setting is enabled but the auth_failed_logon_count search field is always 0

Cause

This is because by default this isn't tracked by Windows unless DisplayLastLogonInfo is enabled

Resolution

Enable DisplayLastLoginInfo via the Windows Registry or GPO

Additional Notes

Engineering is looking into calculating this independently in the future as well so it's not dependent on the Windows setting being enabled

Related Content

https://admx.help/?Category=Windows_10_2016&Policy=Microsoft.Policies.WindowsLogon2::DisplayLastLogo...