Windows Account Usage
User account information can be collected and audited. Tracking local account usage can help detect Pass the Hash activity and other unauthorized account usage. Additional information such as remote desktop logins, users added to privileged groups, and account lockouts can also be tracked. User accounts being promoted to privileged groups should be audited very closely to ensure that users are in fact supposed to be in a privileged group. Unauthorized membership in privileged groups is a strong indicator that malicious activity has occurred. Lockout events for domain accounts are generated on the domain controller whereas lockout events for local accounts are generated on the local computer.
Related Solution
AIS Managed SIEM
Explore our Solutions
Organizations are constantly faced with the challenge of adopting new technologies while safeguarding against potential security threats. The need for robust IT solutions has never been more pressing.

AIS Labs
AIS offers a variety of technology solutions leveraging enterprise open-source software, developed and maintained by AIS engineers. These include AIS Managed Firewall, NMS, SIEM, and VoIP.
Last modified
September 14, 2021