Windows Registry - SAM log, what identifies a failed log on attempt?

-1

I am new to the registry, I am looking at a log and trying to determine when the last failed login attempt was for the Student user..how would I determine this? Thanks in advance! 

Sun Aug  2 19:44:34 2015Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Account\Users\000003E9 
Sun Aug  2 19:44:34 2015Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Account\Users\000003E9 
Sun Aug  2 19:44:34 2015Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Account\Users\000003E9 
Wed Dec 11 19:15:17 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Account 
Wed Dec 11 19:15:17 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Account\Groups\00000201 
Wed Dec 11 19:15:17 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Account\Users 
Wed Dec 11 19:15:17 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Account\Users\Names 
Wed Dec 11 19:15:17 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Account\Users\Names\student 
Wed Dec 11 19:15:17 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Builtin 
Wed Dec 11 19:15:17 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Builtin\Aliases\00000220 
Wed Dec 11 19:15:17 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Builtin\Aliases\00000221 
Wed Dec 11 19:15:17 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Builtin\Aliases\Members\S-1-5-21-4148432325-2076671351-2709350744 
Wed Dec 11 19:15:17 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Builtin\Aliases\Members\S-1-5-21-4148432325-2076671351-2709350744\000003E9 
Wed Dec 11 19:15:17 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Account 
Wed Dec 11 19:15:17 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Account\Groups\00000201 
Wed Dec 11 19:15:17 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Account\Users 
Wed Dec 11 19:15:17 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Account\Users\Names 
Wed Dec 11 19:15:17 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Account\Users\Names\student 
Wed Dec 11 19:15:17 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Builtin 
Wed Dec 11 19:15:17 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Builtin\Aliases\00000220 
Wed Dec 11 19:15:17 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Builtin\Aliases\00000221 
Wed Dec 11 19:15:17 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Builtin\Aliases\Members\S-1-5-21-4148432325-2076671351-2709350744 
Wed Dec 11 19:15:17 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Builtin\Aliases\Members\S-1-5-21-4148432325-2076671351-2709350744\000003E9 
Wed Dec 11 19:15:17 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Account 
Wed Dec 11 19:15:17 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Account\Groups\00000201 
Wed Dec 11 19:15:17 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Account\Users 
Wed Dec 11 19:15:17 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Account\Users\Names 
Wed Dec 11 19:15:17 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Account\Users\Names\student 
Wed Dec 11 19:15:17 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Builtin 
Wed Dec 11 19:15:17 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Builtin\Aliases\00000220 
Wed Dec 11 19:15:17 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Builtin\Aliases\00000221 
Wed Dec 11 19:15:17 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Builtin\Aliases\Members\S-1-5-21-4148432325-2076671351-2709350744 
Wed Dec 11 19:15:17 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Builtin\Aliases\Members\S-1-5-21-4148432325-2076671351-2709350744\000003E9 
Fri Dec  6 21:42:16 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Account\Groups\Names 
Fri Dec  6 21:42:16 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Account\Groups\Names\None 
Fri Dec  6 21:42:16 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Account\Users\Names\Administrator 
Fri Dec  6 21:42:16 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Account\Users\Names\Guest 
Fri Dec  6 21:42:16 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Builtin\Aliases\Names 
Fri Dec  6 21:42:16 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Builtin\Aliases\Names\Access Control Assistance Operators 
Fri Dec  6 21:42:16 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Builtin\Aliases\Names\Administrators 
Fri Dec  6 21:42:16 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Builtin\Aliases\Names\Backup Operators 
Fri Dec  6 21:42:16 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Builtin\Aliases\Names\Cryptographic Operators 
Fri Dec  6 21:42:16 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Builtin\Aliases\Names\Distributed COM Users 
Fri Dec  6 21:42:16 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Builtin\Aliases\Names\Event Log Readers 
Fri Dec  6 21:42:16 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Builtin\Aliases\Names\Guests 
Fri Dec  6 21:42:16 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Builtin\Aliases\Names\Hyper-V Administrators 
Fri Dec  6 21:42:16 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Builtin\Aliases\Names\IIS_IUSRS 
Fri Dec  6 21:42:16 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Builtin\Aliases\Names\Network Configuration Operators 
Fri Dec  6 21:42:16 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Builtin\Aliases\Names\Performance Log Users 
Fri Dec  6 21:42:16 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Builtin\Aliases\Names\Performance Monitor Users 
Fri Dec  6 21:42:16 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Builtin\Aliases\Names\Power Users 
Fri Dec  6 21:42:16 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Builtin\Aliases\Names\Remote Desktop Users 
Fri Dec  6 21:42:16 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Builtin\Aliases\Names\Remote Management Users 
Fri Dec  6 21:42:16 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Builtin\Aliases\Names\Replicator 
Fri Dec  6 21:42:16 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Builtin\Aliases\Names\Users 
Fri Dec  6 21:42:16 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Account\Groups\Names 
Fri Dec  6 21:42:16 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Account\Groups\Names\None 
Fri Dec  6 21:42:16 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Account\Users\Names\Administrator 
Fri Dec  6 21:42:16 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Account\Users\Names\Guest 
Fri Dec  6 21:42:16 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Builtin\Aliases\Names 
Fri Dec  6 21:42:16 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Builtin\Aliases\Names\Access Control Assistance Operators 
Fri Dec  6 21:42:16 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Builtin\Aliases\Names\Administrators 
Fri Dec  6 21:42:16 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Builtin\Aliases\Names\Backup Operators 
Fri Dec  6 21:42:16 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Builtin\Aliases\Names\Cryptographic Operators 
Fri Dec  6 21:42:16 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Builtin\Aliases\Names\Distributed COM Users 
Fri Dec  6 21:42:16 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Builtin\Aliases\Names\Event Log Readers 
Fri Dec  6 21:42:16 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Builtin\Aliases\Names\Guests 
Fri Dec  6 21:42:16 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Builtin\Aliases\Names\Hyper-V Administrators 
Fri Dec  6 21:42:16 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Builtin\Aliases\Names\IIS_IUSRS 
Fri Dec  6 21:42:16 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Builtin\Aliases\Names\Network Configuration Operators 
Fri Dec  6 21:42:16 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Builtin\Aliases\Names\Performance Log Users 
Fri Dec  6 21:42:16 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Builtin\Aliases\Names\Performance Monitor Users 
Fri Dec  6 21:42:16 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Builtin\Aliases\Names\Power Users 
Fri Dec  6 21:42:16 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Builtin\Aliases\Names\Remote Desktop Users 
Fri Dec  6 21:42:16 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Builtin\Aliases\Names\Remote Management Users 
Fri Dec  6 21:42:16 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Builtin\Aliases\Names\Replicator 
Fri Dec  6 21:42:16 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Builtin\Aliases\Names\Users 
Fri Dec  6 21:42:16 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Account\Groups\Names 
Fri Dec  6 21:42:16 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Account\Groups\Names\None 
Fri Dec  6 21:42:16 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Account\Users\Names\Administrator 
Fri Dec  6 21:42:16 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Account\Users\Names\Guest 
Fri Dec  6 21:42:16 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Builtin\Aliases\Names 
Fri Dec  6 21:42:16 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Builtin\Aliases\Names\Access Control Assistance Operators 
Fri Dec  6 21:42:16 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Builtin\Aliases\Names\Administrators 
Fri Dec  6 21:42:16 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Builtin\Aliases\Names\Backup Operators 
Fri Dec  6 21:42:16 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Builtin\Aliases\Names\Cryptographic Operators 
Fri Dec  6 21:42:16 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Builtin\Aliases\Names\Distributed COM Users 
Fri Dec  6 21:42:16 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Builtin\Aliases\Names\Event Log Readers 
Fri Dec  6 21:42:16 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Builtin\Aliases\Names\Guests 
Fri Dec  6 21:42:16 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Builtin\Aliases\Names\Hyper-V Administrators 
Fri Dec  6 21:42:16 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Builtin\Aliases\Names\IIS_IUSRS 
Fri Dec  6 21:42:16 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Builtin\Aliases\Names\Network Configuration Operators 
Fri Dec  6 21:42:16 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Builtin\Aliases\Names\Performance Log Users 
Fri Dec  6 21:42:16 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Builtin\Aliases\Names\Performance Monitor Users 
Fri Dec  6 21:42:16 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Builtin\Aliases\Names\Power Users 
Fri Dec  6 21:42:16 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Builtin\Aliases\Names\Remote Desktop Users 
Fri Dec  6 21:42:16 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Builtin\Aliases\Names\Remote Management Users 
Fri Dec  6 21:42:16 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Builtin\Aliases\Names\Replicator 
Fri Dec  6 21:42:16 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Builtin\Aliases\Names\Users 
Fri Dec  6 21:41:18 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Account\Users\000001F4 
Fri Dec  6 21:41:18 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Account\Users\000001F5 
Fri Dec  6 21:41:18 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Account\Users\000001F4 
Fri Dec  6 21:41:18 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Account\Users\000001F5 
Fri Dec  6 21:41:18 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Account\Users\000001F4 
Fri Dec  6 21:41:18 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Account\Users\000001F5 
Fri Dec  6 21:39:47 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Builtin\Aliases\00000222 
Fri Dec  6 21:39:47 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Builtin\Aliases\Members 
Fri Dec  6 21:39:47 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Builtin\Aliases\Members\S-1-5-21-4148432325-2076671351-2709350744\000001F4 
Fri Dec  6 21:39:47 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Builtin\Aliases\Members\S-1-5-21-4148432325-2076671351-2709350744\000001F5 
Fri Dec  6 21:39:47 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Builtin\Aliases\00000222 
Fri Dec  6 21:39:47 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Builtin\Aliases\Members 
Fri Dec  6 21:39:47 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Builtin\Aliases\Members\S-1-5-21-4148432325-2076671351-2709350744\000001F4 
Fri Dec  6 21:39:47 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Builtin\Aliases\Members\S-1-5-21-4148432325-2076671351-2709350744\000001F5 
Fri Dec  6 21:39:47 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Builtin\Aliases\00000222 
Fri Dec  6 21:39:47 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Builtin\Aliases\Members 
Fri Dec  6 21:39:47 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Builtin\Aliases\Members\S-1-5-21-4148432325-2076671351-2709350744\000001F4 
Fri Dec  6 21:39:47 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Builtin\Aliases\Members\S-1-5-21-4148432325-2076671351-2709350744\000001F5 
Mon Sep 30 04:03:42 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM 
Mon Sep 30 04:03:42 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Builtin\Aliases 
Mon Sep 30 04:03:42 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Builtin\Aliases\00000223 
Mon Sep 30 04:03:42 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Builtin\Aliases\00000227 
Mon Sep 30 04:03:42 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Builtin\Aliases\00000228 
Mon Sep 30 04:03:42 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Builtin\Aliases\0000022B 
Mon Sep 30 04:03:42 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Builtin\Aliases\0000022C 
Mon Sep 30 04:03:42 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Builtin\Aliases\00000239 
Mon Sep 30 04:03:42 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Builtin\Aliases\00000242 
Mon Sep 30 04:03:42 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Builtin\Aliases\00000243 
Mon Sep 30 04:03:42 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\LastSkuUpgrade 
Mon Sep 30 04:03:42 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM 
Mon Sep 30 04:03:42 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Builtin\Aliases 
Mon Sep 30 04:03:42 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Builtin\Aliases\00000223 
Mon Sep 30 04:03:42 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Builtin\Aliases\00000227 
Mon Sep 30 04:03:42 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Builtin\Aliases\00000228 
Mon Sep 30 04:03:42 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Builtin\Aliases\0000022B 
Mon Sep 30 04:03:42 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Builtin\Aliases\0000022C 
Mon Sep 30 04:03:42 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Builtin\Aliases\00000239 
Mon Sep 30 04:03:42 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Builtin\Aliases\00000242 
Mon Sep 30 04:03:42 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Builtin\Aliases\00000243 
Mon Sep 30 04:03:42 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\LastSkuUpgrade 
Mon Sep 30 04:03:42 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM 
Mon Sep 30 04:03:42 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Builtin\Aliases 
Mon Sep 30 04:03:42 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Builtin\Aliases\00000223 
Mon Sep 30 04:03:42 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Builtin\Aliases\00000227 
Mon Sep 30 04:03:42 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Builtin\Aliases\00000228 
Mon Sep 30 04:03:42 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Builtin\Aliases\0000022B 
Mon Sep 30 04:03:42 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Builtin\Aliases\0000022C 
Mon Sep 30 04:03:42 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Builtin\Aliases\00000239 
Mon Sep 30 04:03:42 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Builtin\Aliases\00000242 
Mon Sep 30 04:03:42 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Builtin\Aliases\00000243 
Mon Sep 30 04:03:42 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\LastSkuUpgrade 
Thu Aug 22 14:46:01 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Account\Aliases 
Thu Aug 22 14:46:01 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Account\Aliases\000003E8 
Thu Aug 22 14:46:01 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Account\Aliases\Names 
Thu Aug 22 14:46:01 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Account\Aliases\Names\WinRMRemoteWMIUsers__ 
Thu Aug 22 14:46:01 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Account\Aliases 
Thu Aug 22 14:46:01 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Account\Aliases\000003E8 
Thu Aug 22 14:46:01 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Account\Aliases\Names 
Thu Aug 22 14:46:01 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Account\Aliases\Names\WinRMRemoteWMIUsers__ 
Thu Aug 22 14:46:01 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Account\Aliases 
Thu Aug 22 14:46:01 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Account\Aliases\000003E8 
Thu Aug 22 14:46:01 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Account\Aliases\Names 
Thu Aug 22 14:46:01 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Account\Aliases\Names\WinRMRemoteWMIUsers__ 
Thu Aug 22 14:45:24 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Builtin\Aliases\Members\S-1-5 
Thu Aug 22 14:45:24 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Builtin\Aliases\Members\S-1-5\00000004 
Thu Aug 22 14:45:24 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Builtin\Aliases\Members\S-1-5\0000000B 
Thu Aug 22 14:45:24 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Builtin\Aliases\Members\S-1-5 
Thu Aug 22 14:45:24 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Builtin\Aliases\Members\S-1-5\00000004 
Thu Aug 22 14:45:24 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Builtin\Aliases\Members\S-1-5\0000000B 
Thu Aug 22 14:45:24 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Builtin\Aliases\Members\S-1-5 
Thu Aug 22 14:45:24 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Builtin\Aliases\Members\S-1-5\00000004 
Thu Aug 22 14:45:24 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Builtin\Aliases\Members\S-1-5\0000000B 
Thu Aug 22 14:45:11 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains 
Thu Aug 22 14:45:11 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Account\Aliases\Members 
Thu Aug 22 14:45:11 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Account\Groups 
Thu Aug 22 14:45:11 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Builtin\Aliases\0000022E 
Thu Aug 22 14:45:11 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Builtin\Aliases\0000022F 
Thu Aug 22 14:45:11 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Builtin\Aliases\00000232 
Thu Aug 22 14:45:11 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Builtin\Aliases\00000238 
Thu Aug 22 14:45:11 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Builtin\Aliases\0000023D 
Thu Aug 22 14:45:11 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Builtin\Aliases\00000244 
Thu Aug 22 14:45:11 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Builtin\Aliases\Members\S-1-5\00000011 
Thu Aug 22 14:45:11 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains 
Thu Aug 22 14:45:11 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Account\Aliases\Members 
Thu Aug 22 14:45:11 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Account\Groups 
Thu Aug 22 14:45:11 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Builtin\Aliases\0000022E 
Thu Aug 22 14:45:11 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Builtin\Aliases\0000022F 
Thu Aug 22 14:45:11 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Builtin\Aliases\00000232 
Thu Aug 22 14:45:11 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Builtin\Aliases\00000238 
Thu Aug 22 14:45:11 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Builtin\Aliases\0000023D 
Thu Aug 22 14:45:11 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Builtin\Aliases\00000244 
Thu Aug 22 14:45:11 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Builtin\Aliases\Members\S-1-5\00000011 
Thu Aug 22 14:45:11 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains 
Thu Aug 22 14:45:11 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Account\Aliases\Members 
Thu Aug 22 14:45:11 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Account\Groups 
Thu Aug 22 14:45:11 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Builtin\Aliases\0000022E 
Thu Aug 22 14:45:11 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Builtin\Aliases\0000022F 
Thu Aug 22 14:45:11 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Builtin\Aliases\00000232 
Thu Aug 22 14:45:11 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Builtin\Aliases\00000238 
Thu Aug 22 14:45:11 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Builtin\Aliases\0000023D 
Thu Aug 22 14:45:11 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Builtin\Aliases\00000244 
Thu Aug 22 14:45:11 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Builtin\Aliases\Members\S-1-5\00000011 
Thu Aug 22 14:45:10 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000} 
Thu Aug 22 14:45:10 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Builtin\Groups 
Thu Aug 22 14:45:10 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Builtin\Groups\Names 
Thu Aug 22 14:45:10 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Builtin\Users 
Thu Aug 22 14:45:10 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Builtin\Users\Names 
Thu Aug 22 14:45:10 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\RXACT 
Thu Aug 22 14:45:10 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000} 
Thu Aug 22 14:45:10 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Builtin\Groups 
Thu Aug 22 14:45:10 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Builtin\Groups\Names 
Thu Aug 22 14:45:10 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Builtin\Users 
Thu Aug 22 14:45:10 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Builtin\Users\Names 
Thu Aug 22 14:45:10 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\RXACT 
Thu Aug 22 14:45:10 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000} 
Thu Aug 22 14:45:10 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Builtin\Groups 
Thu Aug 22 14:45:10 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Builtin\Groups\Names 
Thu Aug 22 14:45:10 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Builtin\Users 
Thu Aug 22 14:45:10 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\Domains\Builtin\Users\Names 
Thu Aug 22 14:45:10 2013Z   CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\SAM\RXACT 
----------------------------------------

subatomic

Posted 2016-05-27T20:47:01.433

Reputation: 11

1The information you submitted does not contain that information. – Ramhound – 2016-05-27T20:50:09.807

1

Why are you looking in the SAM log? You need to look in the Security Event Log for Event ID 4625: An account failed to log on. See also What information appears in the event logs? Any errors? (Event Viewer)

– DavidPostill – 2016-05-27T20:51:22.337

It's in your security event log in eventviewer or eventvwr at cmd line. – Citizen – 2016-05-28T02:03:19.997

Answers

0

I am looking at a log, trying to determine when the last failed login attemp was

You are looking in the wrong log.

Logons (both successful and failed) are logged in the Security Event Log.

The event you need to look for is:

EventID 4625: An account failed to log on

To find such events:

  1. Start -> Run > "eventvwr.exe"

  2. Expand "Windows Logs" on the left side and select "Security"

    enter image description here

  3. In the "Actions" section of the right hand side click "Filter Current Log..."

    enter image description here

  4. In the "Filter Current Log" dialog click "<All Event Ids>", enter "4625", and click "OK":

    enter image description here

  5. If there are any failed logins you will see the events. They look like this:

    enter image description here

  6. In my example you can see:

    Account Name: DavidPostill

Further Reading

DavidPostill

Posted 2016-05-27T20:47:01.433

Reputation: 118 938

Asked: 2016-05-27T20:47:01.433

Viewed: 600 times

Active: 2016-05-28T15:34:50.433