Restrict Logon Hours Auth Failure -- Event ID? RRS feed

  • Question

  • Hi,

    We've setup an account with restricted logon hours which is working fine.  However what I'm trying to do is find the event id that is generated if that account attempts to logon outside of those hours so we can trigger an alert.  It doesn't appear to register as a normal auth or logon failure unless I'm completely missing something.  Does anyone know the event ID that is generated or any other way I can identify this failed attempt outside of allowed hours from the logs.  


    Thursday, September 12, 2019 5:32 PM