> For the complete documentation index, see [llms.txt](https://windows.dfirhandbook.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://windows.dfirhandbook.com/windows-artifacts/account-usage/crowdstrike-searches/event-name-userlogonfailed2.md).

# Event Name - UserLogonFailed2

**Description**

**Platforms:** *Linux, ChromeOS, macOS*

**Platforms:** *Windows*

An event that indicates that a local user attempted to logon, but failed due to bad password. LogonTime is the last successful logon time. The remote information will be present only if the logon originated over the network. RawProcessId will attribute a pid if relevant.

**Fields: Linux, ChromeOS, macOS**

| Field            | Description                                                                                                                                                                                                                                                                                                                                       |
| ---------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| ContextTimeStamp | System time of event creation.                                                                                                                                                                                                                                                                                                                    |
| UserName         |                                                                                                                                                                                                                                                                                                                                                   |
| LogonTime        |                                                                                                                                                                                                                                                                                                                                                   |
| LogonType        | <p>Values:</p><ul><li>INTERACTIVE (2)</li><li>NETWORK (3)</li><li>BATCH (4)</li><li>SERVICE (5)</li><li>PROXY (6)</li><li>UNLOCK (7)</li><li>NETWORK\_CLEARTEXT (8)</li><li>NEW\_CREDENTIALS (9)</li><li>REMOTE\_INTERACTIVE (10)</li><li>CACHED\_INTERACTIVE (11)</li><li>CACHED\_REMOTE\_INTERACTIVE (12)</li><li>CACHED\_UNLOCK (13)</li></ul> |
| UID              | Unix User Identifier.                                                                                                                                                                                                                                                                                                                             |
| UserIsAdmin      | Set to TRUE if this user is a local admin.                                                                                                                                                                                                                                                                                                        |
| PasswordLastSet  |                                                                                                                                                                                                                                                                                                                                                   |
| RemoteAddressIP4 |                                                                                                                                                                                                                                                                                                                                                   |
| RemoteAddressIP6 |                                                                                                                                                                                                                                                                                                                                                   |

<br>