Why are there multiple failed attempts for a user in the failed login table even though the user tried to login only once?

Owned by Agat Support
Last updated: Apr 13, 2022 by Avi J. Levin (Unlicensed)
1 min read

Q: Why are there multiple failed attempts for a user in the failed login table even though the user tried to login only once?

A: The client will sometimes automatically retry invalid credentials. Also, at least two NTLM authentications happen during sign in, one is to sign in and the other is to obtain a client certificate. Obtaining a client cert isn't something that happens on every sign in.