Scan Folder - Authentication Failed?

architect

Dabbler
Joined
May 5, 2020
Messages
11
I'm not that tech-savvy but trying to set up a scan folder on my TrueNAS for my new Canon imageCLASS MF455dw. In TrueNAS, SMB has both SMB1 and NTLMv1 ticked. I use the same SMB credentials that I access from my Windows PC, but I keep getting a login/authentication failure. Thoughts?
 

ChrisRJ

Wizard
Joined
Oct 23, 2020
Messages
1,919
Anything in the log files?
 

architect

Dabbler
Joined
May 5, 2020
Messages
11
Easiest way to see parsible version is midclt call smb.status AUTH_LOG | jq
Not sure why the user name has an @ at the end here when I did not include this in settings:

1672327265034.png


Code:
    "timestamp": "2022-12-28T23:57:35.377987-0500",
    "type": "Authentication",
    "Authentication": {
      "version": {
        "major": 1,
        "minor": 2
      },
      "eventId": 4624,
      "logonId": "0",
      "logonType": 3,
      "status": "NT_STATUS_OK",
      "localAddress": "ipv4:192.168.0.201:445",
      "remoteAddress": "ipv4:192.168.0.24:57930",
      "serviceDescription": "SMB2",
      "authDescription": null,
      "clientDomain": "MicrosoftAccount",
      "clientAccount": "archive",
      "workstation": "XEON",
      "becameAccount": "archive",
      "becameDomain": "FREENAS",
      "becameSid": "S-1-5-21-4283718812-195113649-2401654679-1003",
      "mappedAccount": "archive",
      "mappedDomain": "MicrosoftAccount",
      "netlogonComputer": null,
      "netlogonTrustAccount": null,
      "netlogonNegotiateFlags": "0x00000000",
      "netlogonSecureChannelType": 0,
      "netlogonTrustAccountSid": null,
      "passwordType": "NTLMv2",
      "duration": 5954
    },
    "timestamp_tval": {
      "tv_sec": 1672289855,
      "tv_usec": 377987
    }
  },
  {
    "timestamp": "2022-12-29T00:00:11.836743-0500",
    "type": "Authentication",
    "Authentication": {
      "version": {
        "major": 1,
        "minor": 2
      },
      "eventId": 4624,
      "logonId": "0",
      "logonType": 3,
      "status": "NT_STATUS_OK",
      "localAddress": "ipv4:192.168.0.201:445",
      "remoteAddress": "ipv4:192.168.0.24:58061",
      "serviceDescription": "SMB2",
      "authDescription": null,
      "clientDomain": "FREENAS",
      "clientAccount": "archive",
      "workstation": "XEON",
      "becameAccount": "archive",
      "becameDomain": "FREENAS",
      "becameSid": "S-1-5-21-4283718812-195113649-2401654679-1003",
      "mappedAccount": "archive",
      "mappedDomain": "FREENAS",
      "netlogonComputer": null,
      "netlogonTrustAccount": null,
      "netlogonNegotiateFlags": "0x00000000",
      "netlogonSecureChannelType": 0,
      "netlogonTrustAccountSid": null,
      "passwordType": "NTLMv2",
      "duration": 5576
    },
    "timestamp_tval": {
      "tv_sec": 1672290011,
      "tv_usec": 836743
    }
  },
  {
    "timestamp": "2022-12-29T00:03:36.278430-0500",
    "type": "Authentication",
    "Authentication": {
      "version": {
        "major": 1,
        "minor": 2
      },
      "eventId": 4624,
      "logonId": "0",
      "logonType": 3,
      "status": "NT_STATUS_OK",
      "localAddress": "ipv4:192.168.0.201:445",
      "remoteAddress": "ipv4:192.168.0.100:64225",
      "serviceDescription": "SMB2",
      "authDescription": null,
      "clientDomain": "",
      "clientAccount": "archive",
      "workstation": "CANON1FCC8C",
      "becameAccount": "archive",
      "becameDomain": "FREENAS",
      "becameSid": "S-1-5-21-4283718812-195113649-2401654679-1003",
      "mappedAccount": "archive",
      "mappedDomain": "",
      "netlogonComputer": null,
      "netlogonTrustAccount": null,
      "netlogonNegotiateFlags": "0x00000000",
      "netlogonSecureChannelType": 0,
      "netlogonTrustAccountSid": null,
      "passwordType": "NTLMv2",
      "duration": 104096
    },
    "timestamp_tval": {
      "tv_sec": 1672290216,
      "tv_usec": 278430
    }
  },
  {
    "timestamp": "2022-12-29T00:03:38.497967-0500",
    "type": "Authentication",
    "Authentication": {
      "version": {
        "major": 1,
        "minor": 2
      },
      "eventId": 4624,
      "logonId": "0",
      "logonType": 3,
      "status": "NT_STATUS_OK",
      "localAddress": "ipv4:192.168.0.201:445",
      "remoteAddress": "ipv4:192.168.0.100:64230",
      "serviceDescription": "SMB2",
      "authDescription": null,
      "clientDomain": "",
      "clientAccount": "archive",
      "workstation": "CANON1FCC8C",
      "becameAccount": "archive",
      "becameDomain": "FREENAS",
      "becameSid": "S-1-5-21-4283718812-195113649-2401654679-1003",
      "mappedAccount": "archive",
      "mappedDomain": "",
      "netlogonComputer": null,
      "netlogonTrustAccount": null,
      "netlogonNegotiateFlags": "0x00000000",
      "netlogonSecureChannelType": 0,
      "netlogonTrustAccountSid": null,
      "passwordType": "NTLMv2",
      "duration": 105052
    },
    "timestamp_tval": {
      "tv_sec": 1672290218,
      "tv_usec": 497967
    }
  },
  {
    "timestamp": "2022-12-29T00:03:40.822060-0500",
    "type": "Authentication",
    "Authentication": {
      "version": {
        "major": 1,
        "minor": 2
      },
      "eventId": 4625,
      "logonId": "0",
      "logonType": 3,
      "status": "NT_STATUS_NO_SUCH_USER",
      "localAddress": "ipv4:192.168.0.201:445",
      "remoteAddress": "ipv4:192.168.0.100:64235",
      "serviceDescription": "SMB2",
      "authDescription": null,
      "clientDomain": "",
      "clientAccount": "archive@",
      "workstation": "CANON1FCC8C",
      "becameAccount": null,
      "becameDomain": null,
      "becameSid": null,
      "mappedAccount": "archive@",
      "mappedDomain": "",
      "netlogonComputer": null,
      "netlogonTrustAccount": null,
      "netlogonNegotiateFlags": "0x00000000",
      "netlogonSecureChannelType": 0,
      "netlogonTrustAccountSid": null,
      "passwordType": "NTLMv2",
      "duration": 104868
    },
    "timestamp_tval": {
      "tv_sec": 1672290220,
      "tv_usec": 822060
    }
  },
  {
    "timestamp": "2022-12-29T00:03:40.950801-0500",
    "type": "Authentication",
    "Authentication": {
      "version": {
        "major": 1,
        "minor": 2
      },
      "eventId": 4625,
      "logonId": "0",
      "logonType": 3,
      "status": "NT_STATUS_NO_SUCH_USER",
      "localAddress": "ipv4:192.168.0.201:445",
      "remoteAddress": "ipv4:192.168.0.100:64240",
      "serviceDescription": "SMB2",
      "authDescription": null,
      "clientDomain": "",
      "clientAccount": "archive@",
      "workstation": "CANON1FCC8C",
      "becameAccount": null,
      "becameDomain": null,
      "becameSid": null,
      "mappedAccount": "archive@",
      "mappedDomain": "",
      "netlogonComputer": null,
      "netlogonTrustAccount": null,
      "netlogonNegotiateFlags": "0x00000000",
      "netlogonSecureChannelType": 0,
      "netlogonTrustAccountSid": null,
      "passwordType": "NTLMv1",
      "duration": 103463
    },
    "timestamp_tval": {
      "tv_sec": 1672290220,
      "tv_usec": 950801
    }
  },
  {
    "timestamp": "2022-12-29T00:04:47.877212-0500",
    "type": "Authentication",
    "Authentication": {
      "version": {
        "major": 1,
        "minor": 2
      },
      "eventId": 4625,
      "logonId": "0",
      "logonType": 3,
      "status": "NT_STATUS_NO_SUCH_USER",
      "localAddress": "ipv4:192.168.0.201:445",
      "remoteAddress": "ipv4:192.168.0.104:51475",
      "serviceDescription": "SMB2",
      "authDescription": null,
      "clientDomain": "DESKTOP-MJ1FHDH",
      "clientAccount": "Tina",
      "workstation": "DESKTOP-MJ1FHDH",
      "becameAccount": null,
      "becameDomain": null,
      "becameSid": null,
      "mappedAccount": "Tina",
      "mappedDomain": "DESKTOP-MJ1FHDH",
      "netlogonComputer": null,
      "netlogonTrustAccount": null,
      "netlogonNegotiateFlags": "0x00000000",
      "netlogonSecureChannelType": 0,
      "netlogonTrustAccountSid": null,
      "passwordType": "NTLMv2",
      "duration": 6245
    },
    "timestamp_tval": {
      "tv_sec": 1672290287,
      "tv_usec": 877212
    }
  },
  {
    "timestamp": "2022-12-29T00:04:48.909929-0500",
    "type": "Authentication",
    "Authentication": {
      "version": {
        "major": 1,
        "minor": 2
      },
      "eventId": 4625,
      "logonId": "0",
      "logonType": 3,
      "status": "NT_STATUS_NO_SUCH_USER",
      "localAddress": "ipv4:192.168.0.201:445",
      "remoteAddress": "ipv4:192.168.0.104:51476",
      "serviceDescription": "SMB2",
      "authDescription": null,
      "clientDomain": "DESKTOP-MJ1FHDH",
      "clientAccount": "Tina",
      "workstation": "DESKTOP-MJ1FHDH",
      "becameAccount": null,
      "becameDomain": null,
      "becameSid": null,
      "mappedAccount": "Tina",
      "mappedDomain": "DESKTOP-MJ1FHDH",
      "netlogonComputer": null,
      "netlogonTrustAccount": null,
      "netlogonNegotiateFlags": "0x00000000",
      "netlogonSecureChannelType": 0,
      "netlogonTrustAccountSid": null,
      "passwordType": "NTLMv2",
      "duration": 2200
    },
    "timestamp_tval": {
      "tv_sec": 1672290288,
      "tv_usec": 909929
    }
  },
  {
    "timestamp": "2022-12-29T00:04:59.014929-0500",
    "type": "Authentication",
    "Authentication": {
      "version": {
        "major": 1,
        "minor": 2
      },
      "eventId": 4625,
      "logonId": "0",
      "logonType": 3,
      "status": "NT_STATUS_WRONG_PASSWORD",
      "localAddress": "ipv4:192.168.0.201:445",
      "remoteAddress": "ipv4:192.168.0.104:51477",
      "serviceDescription": "SMB2",
      "authDescription": null,
      "clientDomain": "DESKTOP-MJ1FHDH",
      "clientAccount": "archive",
      "workstation": "DESKTOP-MJ1FHDH",
      "becameAccount": null,
      "becameDomain": null,
      "becameSid": null,
      "mappedAccount": "archive",
      "mappedDomain": "DESKTOP-MJ1FHDH",
      "netlogonComputer": null,
      "netlogonTrustAccount": null,
      "netlogonNegotiateFlags": "0x00000000",
      "netlogonSecureChannelType": 0,
      "netlogonTrustAccountSid": null,
      "passwordType": "NTLMv2",
      "duration": 3655
    },
    "timestamp_tval": {
      "tv_sec": 1672290299,
      "tv_usec": 14929
    }
  },
  {
    "timestamp": "2022-12-29T00:05:08.321199-0500",
    "type": "Authentication",
    "Authentication": {
      "version": {
        "major": 1,
        "minor": 2
      },
      "eventId": 4624,
      "logonId": "0",
      "logonType": 3,
      "status": "NT_STATUS_OK",
      "localAddress": "ipv4:192.168.0.201:445",
      "remoteAddress": "ipv4:192.168.0.104:51505",
      "serviceDescription": "SMB2",
      "authDescription": null,
      "clientDomain": "DESKTOP-MJ1FHDH",
      "clientAccount": "archive",
      "workstation": "DESKTOP-MJ1FHDH",
      "becameAccount": "archive",
      "becameDomain": "FREENAS",
      "becameSid": "S-1-5-21-4283718812-195113649-2401654679-1003",
      "mappedAccount": "archive",
      "mappedDomain": "DESKTOP-MJ1FHDH",
      "netlogonComputer": null,
      "netlogonTrustAccount": null,
      "netlogonNegotiateFlags": "0x00000000",
      "netlogonSecureChannelType": 0,
      "netlogonTrustAccountSid": null,
      "passwordType": "NTLMv2",
      "duration": 3519
    },
    "timestamp_tval": {
      "tv_sec": 1672290308,
      "tv_usec": 321199
    }
  },
  {
    "timestamp": "2022-12-29T00:05:24.603503-0500",
    "type": "Authentication",
    "Authentication": {
      "version": {
        "major": 1,
        "minor": 2
      },
      "eventId": 4624,
      "logonId": "0",
      "logonType": 3,
      "status": "NT_STATUS_OK",
      "localAddress": "ipv4:192.168.0.201:445",
      "remoteAddress": "ipv4:192.168.0.24:58215",
      "serviceDescription": "SMB2",
      "authDescription": null,
      "clientDomain": "FREENAS",
      "clientAccount": "archive",
      "workstation": "XEON",
      "becameAccount": "archive",
      "becameDomain": "FREENAS",
      "becameSid": "S-1-5-21-4283718812-195113649-2401654679-1003",
      "mappedAccount": "archive",
      "mappedDomain": "FREENAS",
      "netlogonComputer": null,
      "netlogonTrustAccount": null,
      "netlogonNegotiateFlags": "0x00000000",
      "netlogonSecureChannelType": 0,
      "netlogonTrustAccountSid": null,
      "passwordType": "NTLMv2",
      "duration": 5702
    },
    "timestamp_tval": {
      "tv_sec": 1672290324,
      "tv_usec": 603503
    }
  },
  {
    "timestamp": "2022-12-29T00:07:10.272667-0500",
    "type": "Authentication",
    "Authentication": {
      "version": {
        "major": 1,
        "minor": 2
      },
      "eventId": 4624,
      "logonId": "0",
      "logonType": 3,
      "status": "NT_STATUS_OK",
      "localAddress": "ipv4:192.168.0.201:445",
      "remoteAddress": "ipv4:192.168.0.100:64247",
      "serviceDescription": "SMB2",
      "authDescription": null,
      "clientDomain": "",
      "clientAccount": "archive",
      "workstation": "CANON1FCC8C",
      "becameAccount": "archive",
      "becameDomain": "FREENAS",
      "becameSid": "S-1-5-21-4283718812-195113649-2401654679-1003",
      "mappedAccount": "archive",
      "mappedDomain": "",
      "netlogonComputer": null,
      "netlogonTrustAccount": null,
      "netlogonNegotiateFlags": "0x00000000",
      "netlogonSecureChannelType": 0,
      "netlogonTrustAccountSid": null,
      "passwordType": "NTLMv2",
      "duration": 102537
    },
    "timestamp_tval": {
      "tv_sec": 1672290430,
      "tv_usec": 272667
    }
  },
  {
    "timestamp": "2022-12-29T00:07:12.453996-0500",
    "type": "Authentication",
    "Authentication": {
      "version": {
        "major": 1,
        "minor": 2
      },
      "eventId": 4624,
      "logonId": "0",
      "logonType": 3,
      "status": "NT_STATUS_OK",
      "localAddress": "ipv4:192.168.0.201:445",
      "remoteAddress": "ipv4:192.168.0.100:64252",
      "serviceDescription": "SMB2",
      "authDescription": null,
      "clientDomain": "",
      "clientAccount": "archive",
      "workstation": "CANON1FCC8C",
      "becameAccount": "archive",
      "becameDomain": "FREENAS",
      "becameSid": "S-1-5-21-4283718812-195113649-2401654679-1003",
      "mappedAccount": "archive",
      "mappedDomain": "",
      "netlogonComputer": null,
      "netlogonTrustAccount": null,
      "netlogonNegotiateFlags": "0x00000000",
      "netlogonSecureChannelType": 0,
      "netlogonTrustAccountSid": null,
      "passwordType": "NTLMv2",
      "duration": 110726
    },
    "timestamp_tval": {
      "tv_sec": 1672290432,
      "tv_usec": 453996
    }
  },
  {
    "timestamp": "2022-12-29T00:07:14.628999-0500",
    "type": "Authentication",
    "Authentication": {
      "version": {
        "major": 1,
        "minor": 2
      },
      "eventId": 4625,
      "logonId": "0",
      "logonType": 3,
      "status": "NT_STATUS_NO_SUCH_USER",
      "localAddress": "ipv4:192.168.0.201:445",
      "remoteAddress": "ipv4:192.168.0.100:64257",
      "serviceDescription": "SMB2",
      "authDescription": null,
      "clientDomain": "",
      "clientAccount": "archive@",
      "workstation": "CANON1FCC8C",
      "becameAccount": null,
      "becameDomain": null,
      "becameSid": null,
      "mappedAccount": "archive@",
      "mappedDomain": "",
      "netlogonComputer": null,
      "netlogonTrustAccount": null,
      "netlogonNegotiateFlags": "0x00000000",
      "netlogonSecureChannelType": 0,
      "netlogonTrustAccountSid": null,
      "passwordType": "NTLMv2",
      "duration": 103756
    },
    "timestamp_tval": {
      "tv_sec": 1672290434,
      "tv_usec": 628999
    }
  },
  {
    "timestamp": "2022-12-29T00:07:14.761032-0500",
    "type": "Authentication",
    "Authentication": {
      "version": {
        "major": 1,
        "minor": 2
      },
      "eventId": 4625,
      "logonId": "0",
      "logonType": 3,
      "status": "NT_STATUS_NO_SUCH_USER",
      "localAddress": "ipv4:192.168.0.201:445",
      "remoteAddress": "ipv4:192.168.0.100:64262",
      "serviceDescription": "SMB2",
      "authDescription": null,
      "clientDomain": "",
      "clientAccount": "archive@",
      "workstation": "CANON1FCC8C",
      "becameAccount": null,
      "becameDomain": null,
      "becameSid": null,
      "mappedAccount": "archive@",
      "mappedDomain": "",
      "netlogonComputer": null,
      "netlogonTrustAccount": null,
      "netlogonNegotiateFlags": "0x00000000",
      "netlogonSecureChannelType": 0,
      "netlogonTrustAccountSid": null,
      "passwordType": "NTLMv1",
      "duration": 104975
    },
    "timestamp_tval": {
      "tv_sec": 1672290434,
      "tv_usec": 761032
    }
  },
  {
    "timestamp": "2022-12-29T00:11:28.610749-0500",
    "type": "Authentication",
    "Authentication": {
      "version": {
        "major": 1,
        "minor": 2
      },
      "eventId": 4624,
      "logonId": "0",
      "logonType": 3,
      "status": "NT_STATUS_OK",
      "localAddress": "ipv4:192.168.0.201:445",
      "remoteAddress": "ipv4:192.168.0.24:58537",
      "serviceDescription": "SMB2",
      "authDescription": null,
      "clientDomain": "FREENAS",
      "clientAccount": "archive",
      "workstation": "XEON",
      "becameAccount": "archive",
      "becameDomain": "FREENAS",
      "becameSid": "S-1-5-21-4283718812-195113649-2401654679-1003",
      "mappedAccount": "archive",
      "mappedDomain": "FREENAS",
      "netlogonComputer": null,
      "netlogonTrustAccount": null,
      "netlogonNegotiateFlags": "0x00000000",
      "netlogonSecureChannelType": 0,
      "netlogonTrustAccountSid": null,
      "passwordType": "NTLMv2",
      "duration": 5479
    },
    "timestamp_tval": {
      "tv_sec": 1672290688,
      "tv_usec": 610749
    }
  },
  {
    "timestamp": "2022-12-29T00:14:08.202939-0500",
    "type": "Authentication",
    "Authentication": {
      "version": {
        "major": 1,
        "minor": 2
      },
      "eventId": 4624,
      "logonId": "0",
      "logonType": 3,
      "status": "NT_STATUS_OK",
      "localAddress": "ipv4:192.168.0.201:445",
      "remoteAddress": "ipv4:192.168.0.100:64269",
      "serviceDescription": "SMB2",
      "authDescription": null,
      "clientDomain": "",
      "clientAccount": "archive",
      "workstation": "CANON1FCC8C",
      "becameAccount": "archive",
      "becameDomain": "FREENAS",
      "becameSid": "S-1-5-21-4283718812-195113649-2401654679-1003",
      "mappedAccount": "archive",
      "mappedDomain": "",
      "netlogonComputer": null,
      "netlogonTrustAccount": null,
      "netlogonNegotiateFlags": "0x00000000",
      "netlogonSecureChannelType": 0,
      "netlogonTrustAccountSid": null,
      "passwordType": "NTLMv2",
      "duration": 105045
    },
    "timestamp_tval": {
      "tv_sec": 1672290848,
      "tv_usec": 202939
    }
  },
  {
    "timestamp": "2022-12-29T00:14:10.404317-0500",
    "type": "Authentication",
    "Authentication": {
      "version": {
        "major": 1,
        "minor": 2
      },
      "eventId": 4624,
      "logonId": "0",
      "logonType": 3,
      "status": "NT_STATUS_OK",
      "localAddress": "ipv4:192.168.0.201:445",
      "remoteAddress": "ipv4:192.168.0.100:64274",
      "serviceDescription": "SMB2",
      "authDescription": null,
      "clientDomain": "",
      "clientAccount": "archive",
      "workstation": "CANON1FCC8C",
      "becameAccount": "archive",
      "becameDomain": "FREENAS",
      "becameSid": "S-1-5-21-4283718812-195113649-2401654679-1003",
      "mappedAccount": "archive",
      "mappedDomain": "",
      "netlogonComputer": null,
      "netlogonTrustAccount": null,
      "netlogonNegotiateFlags": "0x00000000",
      "netlogonSecureChannelType": 0,
      "netlogonTrustAccountSid": null,
      "passwordType": "NTLMv2",
      "duration": 104322
    },
    "timestamp_tval": {
      "tv_sec": 1672290850,
      "tv_usec": 404317
    }
  },
  {
    "timestamp": "2022-12-29T00:14:12.585628-0500",
    "type": "Authentication",
    "Authentication": {
      "version": {
        "major": 1,
        "minor": 2
      },
      "eventId": 4625,
      "logonId": "0",
      "logonType": 3,
      "status": "NT_STATUS_NO_SUCH_USER",
      "localAddress": "ipv4:192.168.0.201:445",
      "remoteAddress": "ipv4:192.168.0.100:64279",
      "serviceDescription": "SMB2",
      "authDescription": null,
      "clientDomain": "",
      "clientAccount": "archive@",
      "workstation": "CANON1FCC8C",
      "becameAccount": null,
      "becameDomain": null,
      "becameSid": null,
      "mappedAccount": "archive@",
      "mappedDomain": "",
      "netlogonComputer": null,
      "netlogonTrustAccount": null,
      "netlogonNegotiateFlags": "0x00000000",
      "netlogonSecureChannelType": 0,
      "netlogonTrustAccountSid": null,
      "passwordType": "NTLMv2",
      "duration": 105093
    },
    "timestamp_tval": {
      "tv_sec": 1672290852,
      "tv_usec": 585628
    }
  },
  {
    "timestamp": "2022-12-29T00:14:12.714890-0500",
    "type": "Authentication",
    "Authentication": {
      "version": {
        "major": 1,
        "minor": 2
      },
      "eventId": 4625,
      "logonId": "0",
      "logonType": 3,
      "status": "NT_STATUS_NO_SUCH_USER",
      "localAddress": "ipv4:192.168.0.201:445",
      "remoteAddress": "ipv4:192.168.0.100:64284",
      "serviceDescription": "SMB2",
      "authDescription": null,
      "clientDomain": "",
      "clientAccount": "archive@",
      "workstation": "CANON1FCC8C",
      "becameAccount": null,
      "becameDomain": null,
      "becameSid": null,
      "mappedAccount": "archive@",
      "mappedDomain": "",
      "netlogonComputer": null,
      "netlogonTrustAccount": null,
      "netlogonNegotiateFlags": "0x00000000",
      "netlogonSecureChannelType": 0,
      "netlogonTrustAccountSid": null,
      "passwordType": "NTLMv1",
      "duration": 104888
    },
    "timestamp_tval": {
      "tv_sec": 1672290852,
      "tv_usec": 714890
    }
  },
  {
    "timestamp": "2022-12-29T00:18:07.003597-0500",
    "type": "Authentication",
    "Authentication": {
      "version": {
        "major": 1,
        "minor": 2
      },
      "eventId": 4624,
      "logonId": "0",
      "logonType": 3,
      "status": "NT_STATUS_OK",
      "localAddress": "ipv4:192.168.0.201:445",
      "remoteAddress": "ipv4:192.168.0.24:58621",
      "serviceDescription": "SMB2",
      "authDescription": null,
      "clientDomain": "FREENAS",
      "clientAccount": "archive",
      "workstation": "XEON",
      "becameAccount": "archive",
      "becameDomain": "FREENAS",
      "becameSid": "S-1-5-21-4283718812-195113649-2401654679-1003",
      "mappedAccount": "archive",
      "mappedDomain": "FREENAS",
      "netlogonComputer": null,
      "netlogonTrustAccount": null,
      "netlogonNegotiateFlags": "0x00000000",
      "netlogonSecureChannelType": 0,
      "netlogonTrustAccountSid": null,
      "passwordType": "NTLMv2",
      "duration": 4814
    },
    "timestamp_tval": {
      "tv_sec": 1672291087,
      "tv_usec": 3597
    }
  },
  {
    "timestamp": "2022-12-29T00:28:52.095901-0500",
    "type": "Authentication",
    "Authentication": {
      "version": {
        "major": 1,
        "minor": 2
      },
      "eventId": 4624,
      "logonId": "0",
      "logonType": 3,
      "status": "NT_STATUS_OK",
      "localAddress": "ipv4:192.168.0.201:445",
      "remoteAddress": "ipv4:192.168.0.12:58496",
      "serviceDescription": "SMB2",
      "authDescription": null,
      "clientDomain": "MicrosoftAccount",
      "clientAccount": "archive",
      "workstation": "TOUCHBOOK",
      "becameAccount": "archive",
      "becameDomain": "FREENAS",
      "becameSid": "S-1-5-21-4283718812-195113649-2401654679-1003",
      "mappedAccount": "archive",
      "mappedDomain": "MicrosoftAccount",
      "netlogonComputer": null,
      "netlogonTrustAccount": null,
      "netlogonNegotiateFlags": "0x00000000",
      "netlogonSecureChannelType": 0,
      "netlogonTrustAccountSid": null,
      "passwordType": "NTLMv2",
      "duration": 2446
    },
    "timestamp_tval": {
      "tv_sec": 1672291732,
      "tv_usec": 95901
    }
  },
  {
    "timestamp": "2022-12-29T00:29:09.575760-0500",
    "type": "Authentication",
    "Authentication": {
      "version": {
        "major": 1,
        "minor": 2
      },
      "eventId": 4624,
      "logonId": "0",
      "logonType": 3,
      "status": "NT_STATUS_OK",
      "localAddress": "ipv4:192.168.0.201:445",
      "remoteAddress": "ipv4:192.168.0.24:59450",
      "serviceDescription": "SMB2",
      "authDescription": null,
      "clientDomain": "FREENAS",
      "clientAccount": "archive",
      "workstation": "XEON",
      "becameAccount": "archive",
      "becameDomain": "FREENAS",
      "becameSid": "S-1-5-21-4283718812-195113649-2401654679-1003",
      "mappedAccount": "archive",
      "mappedDomain": "FREENAS",
      "netlogonComputer": null,
      "netlogonTrustAccount": null,
      "netlogonNegotiateFlags": "0x00000000",
      "netlogonSecureChannelType": 0,
      "netlogonTrustAccountSid": null,
      "passwordType": "NTLMv2",
      "duration": 5590
    },
    "timestamp_tval": {
      "tv_sec": 1672291749,
      "tv_usec": 575760
    }
  },
  {
    "timestamp": "2022-12-29T00:34:53.215148-0500",
    "type": "Authentication",
    "Authentication": {
      "version": {
        "major": 1,
        "minor": 2
      },
      "eventId": 4624,
      "logonId": "0",
      "logonType": 3,
      "status": "NT_STATUS_OK",
      "localAddress": "ipv4:192.168.0.201:445",
      "remoteAddress": "ipv4:192.168.0.100:64291",
      "serviceDescription": "SMB2",
      "authDescription": null,
      "clientDomain": "",
      "clientAccount": "archive",
      "workstation": "CANON1FCC8C",
      "becameAccount": "archive",
      "becameDomain": "FREENAS",
      "becameSid": "S-1-5-21-4283718812-195113649-2401654679-1003",
      "mappedAccount": "archive",
      "mappedDomain": "",
      "netlogonComputer": null,
      "netlogonTrustAccount": null,
      "netlogonNegotiateFlags": "0x00000000",
      "netlogonSecureChannelType": 0,
      "netlogonTrustAccountSid": null,
      "passwordType": "NTLMv2",
      "duration": 104338
    },
    "timestamp_tval": {
      "tv_sec": 1672292093,
      "tv_usec": 215148
    }
  },
  {
    "timestamp": "2022-12-29T00:34:55.409554-0500",
    "type": "Authentication",
    "Authentication": {
      "version": {
        "major": 1,
        "minor": 2
      },
      "eventId": 4624,
      "logonId": "0",
      "logonType": 3,
      "status": "NT_STATUS_OK",
      "localAddress": "ipv4:192.168.0.201:445",
      "remoteAddress": "ipv4:192.168.0.100:64296",
      "serviceDescription": "SMB2",
      "authDescription": null,
      "clientDomain": "",
      "clientAccount": "archive",
      "workstation": "CANON1FCC8C",
      "becameAccount": "archive",
      "becameDomain": "FREENAS",
      "becameSid": "S-1-5-21-4283718812-195113649-2401654679-1003",
      "mappedAccount": "archive",
      "mappedDomain": "",
      "netlogonComputer": null,
      "netlogonTrustAccount": null,
      "netlogonNegotiateFlags": "0x00000000",
      "netlogonSecureChannelType": 0,
      "netlogonTrustAccountSid": null,
      "passwordType": "NTLMv2",
      "duration": 104021
    },
    "timestamp_tval": {
      "tv_sec": 1672292095,
      "tv_usec": 409554
    }
  },
  {
    "timestamp": "2022-12-29T00:34:57.752321-0500",
    "type": "Authentication",
    "Authentication": {
      "version": {
        "major": 1,
        "minor": 2
      },
      "eventId": 4625,
      "logonId": "0",
      "logonType": 3,
      "status": "NT_STATUS_NO_SUCH_USER",
      "localAddress": "ipv4:192.168.0.201:445",
      "remoteAddress": "ipv4:192.168.0.100:64301",
      "serviceDescription": "SMB2",
      "authDescription": null,
      "clientDomain": "",
      "clientAccount": "archive@",
      "workstation": "CANON1FCC8C",
      "becameAccount": null,
      "becameDomain": null,
      "becameSid": null,
      "mappedAccount": "archive@",
      "mappedDomain": "",
      "netlogonComputer": null,
      "netlogonTrustAccount": null,
      "netlogonNegotiateFlags": "0x00000000",
      "netlogonSecureChannelType": 0,
      "netlogonTrustAccountSid": null,
      "passwordType": "NTLMv2",
      "duration": 103564
    },
    "timestamp_tval": {
      "tv_sec": 1672292097,
      "tv_usec": 752321
    }
  },
  {
    "timestamp": "2022-12-29T00:34:57.886292-0500",
    "type": "Authentication",
    "Authentication": {
      "version": {
        "major": 1,
        "minor": 2
      },
      "eventId": 4625,
      "logonId": "0",
      "logonType": 3,
      "status": "NT_STATUS_NO_SUCH_USER",
      "localAddress": "ipv4:192.168.0.201:445",
      "remoteAddress": "ipv4:192.168.0.100:64306",
      "serviceDescription": "SMB2",
      "authDescription": null,
      "clientDomain": "",
      "clientAccount": "archive@",
      "workstation": "CANON1FCC8C",
      "becameAccount": null,
      "becameDomain": null,
      "becameSid": null,
      "mappedAccount": "archive@",
      "mappedDomain": "",
      "netlogonComputer": null,
      "netlogonTrustAccount": null,
      "netlogonNegotiateFlags": "0x00000000",
      "netlogonSecureChannelType": 0,
      "netlogonTrustAccountSid": null,
      "passwordType": "NTLMv1",
      "duration": 104994
    }
 
Top