ADFS - Unable to trace domain account login attempts.

On our ADFS servers (We have 2) are getting multiple failed login attempts from a particular user. Can we trace where they are coming from? These attempts are happening every 5 Minutes. Below are the security logs for these login attempts.

               Below is a table of failed login attempts and from what server. They all have the same event ID’s in event viewer 4771 & 4625

Below are the event ID 4771 and 4625 logs

Audit Failure - Event ID 4771

Kerberos pre-authentication failed.

Account Information:

                Security ID:                            Domain\Account Trying to Login

                Account Name:                     Account Trying to Login

Service Information:

                Service Name:                       krbtgt/****************************************

Network Information:

                Client Address:                      ::1

                Client Port:                             0

Additional Information:

                Ticket Options:                      0x40810010

                Failure Code:                         0x18

                Pre-Authentication Type:     2

Certificate Information:

                Certificate Issuer Name:                      

                Certificate Serial Number:  

                Certificate Thumbprint:                       

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options and failure codes are defined in RFC 4120.

If the ticket was malformed or damaged during transit and could not be decrypted, then many fields in this event might not be present.

Audit Failure - Event ID 4625

An account failed to log on.

Subject:

                Security ID:                            *****\ADFS Account

                Account Name:                     ADFS Account

                Account Domain:                  *********

                Logon ID:                               0x167BB

Logon Type:                                           3

Account For Which Logon Failed:

                Security ID:                            NULL SID

                Account Name:                     ******@****** (Account Trying to Login)

                Account Domain:                 

Failure Information:

                Failure Reason:                     Unknown user name or bad password.

                Status:                                    0xC000006D

                Sub Status:                            0xC000006A

Process Information:

                Caller Process ID:  0x5f8(This is the adfssrv proces)

                Caller Process Name:           C:\Windows\ADFS\Microsoft.IdentityServer.ServiceHost.exe

Network Information:

                Workstation Name:              Server logs have come from

                Source Network Address:     -

                Source Port:                           -

Detailed Authentication Information:

                Logon Process:                       W

                Authentication Package:     Negotiate

                Transited Services: -

                Package Name (NTLM only):              -

                Key Length:                           0

This event is generated when a logon request fails. It is generated on the computer where access was attempted.

The Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).

The Process Information fields indicate which account and process on the system requested the logon.

The Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The authentication information fields provide detailed information about this specific logon request.

                - Transited services indicate which intermediate services have participated in this logon request.

                - Package name indicates which sub-protocol was used among the NTLM protocols.

                - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.

Now looking in the ADFS event viewer it has the Event ID 342 at the same time as the failed login attempts

Token validation failed. 

Additional Data

Token Type:

(Omitted due to unable to submit link)

%Error message:

AccountTrying to login -The user name or password is incorrect

Exception details:

System.IdentityModel.Tokens.SecurityTokenValidationException:AccountTrying to login ---> System.ComponentModel.Win32Exception: The user name or password is incorrect

   at Microsoft.IdentityServer.Service.Tokens.LsaLogonUserHelper.GetLsaLogonUserHandle(SafeHGlobalHandle pLogonInfo, Int32 logonInfoSize, SafeCloseHandle& tokenHandle, SafeLsaReturnBufferHandle& profileHandle)

   at Microsoft.IdentityServer.Service.Tokens.LsaLogonUserHelper.GetLsaLogonUserInfo(SafeHGlobalHandle pLogonInfo, Int32 logonInfoSize, DateTime& nextPasswordChange, DateTime& lastPasswordChange, String authenticationType, String issuerName)

   at Microsoft.IdentityServer.Service.Tokens.LsaLogonUserHelper.GetLsaLogonUser(UserNameSecurityToken token, DateTime& nextPasswordChange, DateTime& lastPasswordChange, String issuerName)

   at Microsoft.IdentityServer.Service.Tokens.MSISWindowsUserNameSecurityTokenHandler.ValidateTokenInternal(SecurityToken token)

   --- End of inner exception stack trace ---

   at Microsoft.IdentityServer.Service.Tokens.MSISWindowsUserNameSecurityTokenHandler.ValidateTokenInternal(SecurityToken token)

   at Microsoft.IdentityServer.Service.Tokens.MSISWindowsUserNameSecurityTokenHandler.ValidateToken(SecurityToken token)

System.ComponentModel.Win32Exception (0x80004005): The user name or password is incorrect

   at Microsoft.IdentityServer.Service.Tokens.LsaLogonUserHelper.GetLsaLogonUserHandle(SafeHGlobalHandle pLogonInfo, Int32 logonInfoSize, SafeCloseHandle& tokenHandle, SafeLsaReturnBufferHandle& profileHandle)

   at Microsoft.IdentityServer.Service.Tokens.LsaLogonUserHelper.GetLsaLogonUserInfo(SafeHGlobalHandle pLogonInfo, Int32 logonInfoSize, DateTime& nextPasswordChange, DateTime& lastPasswordChange, String authenticationType, String issuerName)

   at Microsoft.IdentityServer.Service.Tokens.LsaLogonUserHelper.GetLsaLogonUser(UserNameSecurityToken token, DateTime& nextPasswordChange, DateTime& lastPasswordChange, String issuerName)

   at Microsoft.IdentityServer.Service.Tokens.MSISWindowsUserNameSecurityTokenHandler.ValidateTokenInternal(SecurityToken token)

As the login attempts are coming from the ADFS server, I assumed they are coming from Azure however when looking at this users sign in attempts on the Azure portal there are no failed attempts.

So how can a trace where these login attempts are coming from? Bearing in mind that according to the event log, they are coming from the ADFS server. How can I find out what is attempting to login to the affected account through the ADFS server.

Thanks,

Sean