{"id":4904,"date":"2025-06-12T16:28:41","date_gmt":"2025-06-12T16:28:41","guid":{"rendered":"https:\/\/blog.databyte.cl\/?p=4904"},"modified":"2025-06-12T20:08:10","modified_gmt":"2025-06-12T20:08:10","slug":"como-detectar-intentos-fallidos-de-inicio-de-sesion-en-windows-evento-4625-y-exportarlos-a-csv","status":"publish","type":"post","link":"https:\/\/blog.databyte.cl\/index.php\/2025\/06\/12\/como-detectar-intentos-fallidos-de-inicio-de-sesion-en-windows-evento-4625-y-exportarlos-a-csv\/","title":{"rendered":"C\u00f3mo detectar intentos fallidos de inicio de sesi\u00f3n en Windows (evento 4625) y exportarlos a CSV"},"content":{"rendered":"\n<p>En este tutorial aprender\u00e1s a detectar accesos fallidos a un equipo con Windows Server (o cualquier Windows que registre eventos de seguridad), espec\u00edficamente los <strong>intentos de inicio de sesi\u00f3n fallidos<\/strong> registrados como <strong>evento 4625<\/strong> en el Visor de eventos.<\/p>\n\n\n\n<p>Tambi\u00e9n aprender\u00e1s a <strong>exportarlos f\u00e1cilmente a un archivo CSV<\/strong> o visualizarlos directamente en pantalla, usando un script PowerShell reutilizable que puedes ejecutar con par\u00e1metros personalizados.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">\u00bfPor qu\u00e9 es importante monitorear el evento 4625?<\/h2>\n\n\n\n<p>Cada vez que un usuario (o atacante) intenta ingresar con un usuario o contrase\u00f1a incorrecta, Windows genera un evento con ID <strong>4625<\/strong> en el registro de seguridad. Analizar estos eventos permite:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Detectar intentos de fuerza bruta por RDP o SMB.<\/li>\n\n\n\n<li>Identificar usuarios mal configurados.<\/li>\n\n\n\n<li>Localizar dispositivos que est\u00e1n enviando credenciales incorrectas.<\/li>\n\n\n\n<li>Prevenir bloqueos masivos de cuentas.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Requisitos<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li>PowerShell (presente por defecto en Windows Server y Windows 10+).<\/li>\n\n\n\n<li>Permisos de administrador local.<\/li>\n\n\n\n<li>El registro de auditor\u00eda de seguridad debe estar activado (por defecto lo est\u00e1 en servidores).<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Script PowerShell para detectar eventos 4625<\/h2>\n\n\n\n<p>Copia el siguiente c\u00f3digo en un archivo llamado, por ejemplo: <strong>ver_errores_logon.ps1<\/strong><\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>param(<br>    [int]$Horas = 24,<br>    [switch]$Dias,<br>    [switch]$Exportar<br>)<br><br># Calcular tiempo de inicio<br>if ($Dias) {<br>    $fechaInicio = (Get-Date).AddDays(-$Horas)<br>} else {<br>    $fechaInicio = (Get-Date).AddHours(-$Horas)<br>}<br><br>Write-Host \"Buscando eventos 4625 desde $fechaInicio ...\" -ForegroundColor Cyan<br><br># Obtener eventos<br>$resultado = Get-WinEvent -FilterHashtable @{LogName='Security'; ID=4625; StartTime=$fechaInicio} | ForEach-Object {<br>    $xml = [xml]$_.ToXml()<br>    [PSCustomObject]@{<br>        Fecha         = $_.TimeCreated<br>        Usuario       = $xml.Event.EventData.Data | Where-Object {$_.Name -eq \"TargetUserName\"} | Select-Object -ExpandProperty '#text'<br>        Dominio       = $xml.Event.EventData.Data | Where-Object {$_.Name -eq \"TargetDomainName\"} | Select-Object -ExpandProperty '#text'<br>        IP_Origen     = $xml.Event.EventData.Data | Where-Object {$_.Name -eq \"IpAddress\"} | Select-Object -ExpandProperty '#text'<br>        Host_Origen   = $xml.Event.EventData.Data | Where-Object {$_.Name -eq \"WorkstationName\"} | Select-Object -ExpandProperty '#text'<br>        Motivo        = $xml.Event.EventData.Data | Where-Object {$_.Name -eq \"FailureReason\"} | Select-Object -ExpandProperty '#text'<br>    }<br>}<br><br># Mostrar o exportar seg\u00fan par\u00e1metro<br>if ($Exportar) {<br>    $ruta = \"$env:USERPROFILE\\Escritorio\\logins_fallidos.csv\"<br>    $resultado | Export-Csv -Path $ruta -NoTypeInformation -Encoding UTF8<br>    Write-Host \"Exportado a: $ruta\" -ForegroundColor Green<br>} else {<br>    $resultado | Format-Table -AutoSize<br>}<\/code><\/pre>\n\n\n\n<h4 class=\"wp-block-heading\">\u00bfC\u00f3mo usar el script?<\/h4>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Copia el archivo <strong>.ps1<\/strong> a tu servidor o equipo.<\/li>\n\n\n\n<li>Abre PowerShell <strong>como administrador<\/strong>.<\/li>\n\n\n\n<li>Ejecuta el script con los par\u00e1metros deseados:<\/li>\n<\/ol>\n\n\n\n<p>Ejemplos:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Mostrar en pantalla los \u00faltimos 24 horas (por defecto):<\/li>\n<\/ul>\n\n\n\n<pre class=\"wp-block-code\"><code>.\\ver_errores_logon.ps1<\/code><\/pre>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Ver los \u00faltimos 2 d\u00edas:<\/li>\n<\/ul>\n\n\n\n<pre class=\"wp-block-code\"><code>.\\ver_errores_logon.ps1 -Horas 2 -Dias<\/code><\/pre>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Exportar a CSV los \u00faltimos 48 horas:<\/li>\n<\/ul>\n\n\n\n<pre class=\"wp-block-code\"><code>.\\ver_errores_logon.ps1 -Horas 48 -Exportar<\/code><\/pre>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Exportar a CSV los \u00faltimos 3 d\u00edas:<\/li>\n<\/ul>\n\n\n\n<pre class=\"wp-block-code\"><code>.\\ver_errores_logon.ps1 -Horas 3 -Dias -Exportar<\/code><\/pre>\n\n\n\n<h4 class=\"wp-block-heading\">\u00bfQu\u00e9 informaci\u00f3n contiene el resultado?<\/h4>\n\n\n\n<p>El reporte incluye:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Fecha y hora del intento.<\/li>\n\n\n\n<li>Usuario y dominio fallido.<\/li>\n\n\n\n<li>IP de origen.<\/li>\n\n\n\n<li>Host o estaci\u00f3n desde donde se hizo el intento.<\/li>\n\n\n\n<li>Motivo del fallo (usuario inexistente, clave incorrecta, etc.)<\/li>\n<\/ul>\n\n\n\n<p><\/p>\n","protected":false},"excerpt":{"rendered":"<p>En este tutorial aprender\u00e1s a detectar accesos fallidos a un equipo con Windows Server (o cualquier Windows que registre eventos de seguridad), espec\u00edficamente los intentos de inicio de sesi\u00f3n fallidos registrados como evento 4625 en el Visor de eventos. Tambi\u00e9n aprender\u00e1s a exportarlos f\u00e1cilmente a un archivo CSV o visualizarlos directamente en pantalla, usando un&#8230; <\/p>\n<div class=\"link-more\"><a href=\"https:\/\/blog.databyte.cl\/index.php\/2025\/06\/12\/como-detectar-intentos-fallidos-de-inicio-de-sesion-en-windows-evento-4625-y-exportarlos-a-csv\/\">Lea m\u00e1s<\/a><\/div>\n","protected":false},"author":8,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_lmt_disableupdate":"","_lmt_disable":"","ep_exclude_from_search":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[21],"tags":[68],"class_list":["post-4904","post","type-post","status-publish","format-standard","hentry","category-nagios","tag-windows"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v26.8 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>C\u00f3mo detectar intentos fallidos de inicio de sesi\u00f3n en Windows (evento 4625) y exportarlos a CSV - Blog Databyte<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/blog.databyte.cl\/index.php\/2025\/06\/12\/como-detectar-intentos-fallidos-de-inicio-de-sesion-en-windows-evento-4625-y-exportarlos-a-csv\/\" \/>\n<meta property=\"og:locale\" content=\"es_ES\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"C\u00f3mo detectar intentos fallidos de inicio de sesi\u00f3n en Windows (evento 4625) y exportarlos a CSV - Blog Databyte\" \/>\n<meta property=\"og:description\" content=\"En este tutorial aprender\u00e1s a detectar accesos fallidos a un equipo con Windows Server (o cualquier Windows que registre eventos de seguridad), espec\u00edficamente los intentos de inicio de sesi\u00f3n fallidos registrados como evento 4625 en el Visor de eventos. Tambi\u00e9n aprender\u00e1s a exportarlos f\u00e1cilmente a un archivo CSV o visualizarlos directamente en pantalla, usando un... Lea m\u00e1s\" \/>\n<meta property=\"og:url\" content=\"https:\/\/blog.databyte.cl\/index.php\/2025\/06\/12\/como-detectar-intentos-fallidos-de-inicio-de-sesion-en-windows-evento-4625-y-exportarlos-a-csv\/\" \/>\n<meta property=\"og:site_name\" content=\"Blog Databyte\" \/>\n<meta property=\"article:published_time\" content=\"2025-06-12T16:28:41+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2025-06-12T20:08:10+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/blog.databyte.cl\/wp-content\/uploads\/2024\/09\/favicon-original.png\" \/>\n\t<meta property=\"og:image:width\" content=\"189\" \/>\n\t<meta property=\"og:image:height\" content=\"62\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"Miguel Carmona\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Escrito por\" \/>\n\t<meta name=\"twitter:data1\" content=\"Miguel Carmona\" \/>\n\t<meta name=\"twitter:label2\" content=\"Tiempo de lectura\" \/>\n\t<meta name=\"twitter:data2\" content=\"2 minutos\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/blog.databyte.cl\/index.php\/2025\/06\/12\/como-detectar-intentos-fallidos-de-inicio-de-sesion-en-windows-evento-4625-y-exportarlos-a-csv\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/blog.databyte.cl\/index.php\/2025\/06\/12\/como-detectar-intentos-fallidos-de-inicio-de-sesion-en-windows-evento-4625-y-exportarlos-a-csv\/\"},\"author\":{\"name\":\"Miguel Carmona\",\"@id\":\"https:\/\/blog.databyte.cl\/#\/schema\/person\/bcee33ff0688a37207b3d42f952d50f4\"},\"headline\":\"C\u00f3mo detectar intentos fallidos de inicio de sesi\u00f3n en Windows (evento 4625) y exportarlos a CSV\",\"datePublished\":\"2025-06-12T16:28:41+00:00\",\"dateModified\":\"2025-06-12T20:08:10+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/blog.databyte.cl\/index.php\/2025\/06\/12\/como-detectar-intentos-fallidos-de-inicio-de-sesion-en-windows-evento-4625-y-exportarlos-a-csv\/\"},\"wordCount\":293,\"publisher\":{\"@id\":\"https:\/\/blog.databyte.cl\/#organization\"},\"keywords\":[\"Windows\"],\"articleSection\":[\"Seguridad y Monitoreo\"],\"inLanguage\":\"es\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/blog.databyte.cl\/index.php\/2025\/06\/12\/como-detectar-intentos-fallidos-de-inicio-de-sesion-en-windows-evento-4625-y-exportarlos-a-csv\/\",\"url\":\"https:\/\/blog.databyte.cl\/index.php\/2025\/06\/12\/como-detectar-intentos-fallidos-de-inicio-de-sesion-en-windows-evento-4625-y-exportarlos-a-csv\/\",\"name\":\"C\u00f3mo detectar intentos fallidos de inicio de sesi\u00f3n en Windows (evento 4625) y exportarlos a CSV - Blog Databyte\",\"isPartOf\":{\"@id\":\"https:\/\/blog.databyte.cl\/#website\"},\"datePublished\":\"2025-06-12T16:28:41+00:00\",\"dateModified\":\"2025-06-12T20:08:10+00:00\",\"breadcrumb\":{\"@id\":\"https:\/\/blog.databyte.cl\/index.php\/2025\/06\/12\/como-detectar-intentos-fallidos-de-inicio-de-sesion-en-windows-evento-4625-y-exportarlos-a-csv\/#breadcrumb\"},\"inLanguage\":\"es\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/blog.databyte.cl\/index.php\/2025\/06\/12\/como-detectar-intentos-fallidos-de-inicio-de-sesion-en-windows-evento-4625-y-exportarlos-a-csv\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/blog.databyte.cl\/index.php\/2025\/06\/12\/como-detectar-intentos-fallidos-de-inicio-de-sesion-en-windows-evento-4625-y-exportarlos-a-csv\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Portada\",\"item\":\"https:\/\/blog.databyte.cl\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"C\u00f3mo detectar intentos fallidos de inicio de sesi\u00f3n en Windows (evento 4625) y exportarlos a CSV\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/blog.databyte.cl\/#website\",\"url\":\"https:\/\/blog.databyte.cl\/\",\"name\":\"Blog Databyte\",\"description\":\"\",\"publisher\":{\"@id\":\"https:\/\/blog.databyte.cl\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/blog.databyte.cl\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"es\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/blog.databyte.cl\/#organization\",\"name\":\"Blog Databyte\",\"url\":\"https:\/\/blog.databyte.cl\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"es\",\"@id\":\"https:\/\/blog.databyte.cl\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/blog.databyte.cl\/wp-content\/uploads\/2024\/09\/favicon-original.png\",\"contentUrl\":\"https:\/\/blog.databyte.cl\/wp-content\/uploads\/2024\/09\/favicon-original.png\",\"width\":189,\"height\":62,\"caption\":\"Blog Databyte\"},\"image\":{\"@id\":\"https:\/\/blog.databyte.cl\/#\/schema\/logo\/image\/\"}},{\"@type\":\"Person\",\"@id\":\"https:\/\/blog.databyte.cl\/#\/schema\/person\/bcee33ff0688a37207b3d42f952d50f4\",\"name\":\"Miguel Carmona\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"es\",\"@id\":\"https:\/\/blog.databyte.cl\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/816da46dc6aeebe927a21c8588b82db83c4241fbc978af1ef97060f329310287?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/816da46dc6aeebe927a21c8588b82db83c4241fbc978af1ef97060f329310287?s=96&d=mm&r=g\",\"caption\":\"Miguel Carmona\"},\"url\":\"https:\/\/blog.databyte.cl\/index.php\/author\/mcarmona\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"C\u00f3mo detectar intentos fallidos de inicio de sesi\u00f3n en Windows (evento 4625) y exportarlos a CSV - Blog Databyte","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/blog.databyte.cl\/index.php\/2025\/06\/12\/como-detectar-intentos-fallidos-de-inicio-de-sesion-en-windows-evento-4625-y-exportarlos-a-csv\/","og_locale":"es_ES","og_type":"article","og_title":"C\u00f3mo detectar intentos fallidos de inicio de sesi\u00f3n en Windows (evento 4625) y exportarlos a CSV - Blog Databyte","og_description":"En este tutorial aprender\u00e1s a detectar accesos fallidos a un equipo con Windows Server (o cualquier Windows que registre eventos de seguridad), espec\u00edficamente los intentos de inicio de sesi\u00f3n fallidos registrados como evento 4625 en el Visor de eventos. Tambi\u00e9n aprender\u00e1s a exportarlos f\u00e1cilmente a un archivo CSV o visualizarlos directamente en pantalla, usando un... Lea m\u00e1s","og_url":"https:\/\/blog.databyte.cl\/index.php\/2025\/06\/12\/como-detectar-intentos-fallidos-de-inicio-de-sesion-en-windows-evento-4625-y-exportarlos-a-csv\/","og_site_name":"Blog Databyte","article_published_time":"2025-06-12T16:28:41+00:00","article_modified_time":"2025-06-12T20:08:10+00:00","og_image":[{"width":189,"height":62,"url":"https:\/\/blog.databyte.cl\/wp-content\/uploads\/2024\/09\/favicon-original.png","type":"image\/png"}],"author":"Miguel Carmona","twitter_card":"summary_large_image","twitter_misc":{"Escrito por":"Miguel Carmona","Tiempo de lectura":"2 minutos"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/blog.databyte.cl\/index.php\/2025\/06\/12\/como-detectar-intentos-fallidos-de-inicio-de-sesion-en-windows-evento-4625-y-exportarlos-a-csv\/#article","isPartOf":{"@id":"https:\/\/blog.databyte.cl\/index.php\/2025\/06\/12\/como-detectar-intentos-fallidos-de-inicio-de-sesion-en-windows-evento-4625-y-exportarlos-a-csv\/"},"author":{"name":"Miguel Carmona","@id":"https:\/\/blog.databyte.cl\/#\/schema\/person\/bcee33ff0688a37207b3d42f952d50f4"},"headline":"C\u00f3mo detectar intentos fallidos de inicio de sesi\u00f3n en Windows (evento 4625) y exportarlos a CSV","datePublished":"2025-06-12T16:28:41+00:00","dateModified":"2025-06-12T20:08:10+00:00","mainEntityOfPage":{"@id":"https:\/\/blog.databyte.cl\/index.php\/2025\/06\/12\/como-detectar-intentos-fallidos-de-inicio-de-sesion-en-windows-evento-4625-y-exportarlos-a-csv\/"},"wordCount":293,"publisher":{"@id":"https:\/\/blog.databyte.cl\/#organization"},"keywords":["Windows"],"articleSection":["Seguridad y Monitoreo"],"inLanguage":"es"},{"@type":"WebPage","@id":"https:\/\/blog.databyte.cl\/index.php\/2025\/06\/12\/como-detectar-intentos-fallidos-de-inicio-de-sesion-en-windows-evento-4625-y-exportarlos-a-csv\/","url":"https:\/\/blog.databyte.cl\/index.php\/2025\/06\/12\/como-detectar-intentos-fallidos-de-inicio-de-sesion-en-windows-evento-4625-y-exportarlos-a-csv\/","name":"C\u00f3mo detectar intentos fallidos de inicio de sesi\u00f3n en Windows (evento 4625) y exportarlos a CSV - Blog Databyte","isPartOf":{"@id":"https:\/\/blog.databyte.cl\/#website"},"datePublished":"2025-06-12T16:28:41+00:00","dateModified":"2025-06-12T20:08:10+00:00","breadcrumb":{"@id":"https:\/\/blog.databyte.cl\/index.php\/2025\/06\/12\/como-detectar-intentos-fallidos-de-inicio-de-sesion-en-windows-evento-4625-y-exportarlos-a-csv\/#breadcrumb"},"inLanguage":"es","potentialAction":[{"@type":"ReadAction","target":["https:\/\/blog.databyte.cl\/index.php\/2025\/06\/12\/como-detectar-intentos-fallidos-de-inicio-de-sesion-en-windows-evento-4625-y-exportarlos-a-csv\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/blog.databyte.cl\/index.php\/2025\/06\/12\/como-detectar-intentos-fallidos-de-inicio-de-sesion-en-windows-evento-4625-y-exportarlos-a-csv\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Portada","item":"https:\/\/blog.databyte.cl\/"},{"@type":"ListItem","position":2,"name":"C\u00f3mo detectar intentos fallidos de inicio de sesi\u00f3n en Windows (evento 4625) y exportarlos a CSV"}]},{"@type":"WebSite","@id":"https:\/\/blog.databyte.cl\/#website","url":"https:\/\/blog.databyte.cl\/","name":"Blog Databyte","description":"","publisher":{"@id":"https:\/\/blog.databyte.cl\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/blog.databyte.cl\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"es"},{"@type":"Organization","@id":"https:\/\/blog.databyte.cl\/#organization","name":"Blog Databyte","url":"https:\/\/blog.databyte.cl\/","logo":{"@type":"ImageObject","inLanguage":"es","@id":"https:\/\/blog.databyte.cl\/#\/schema\/logo\/image\/","url":"https:\/\/blog.databyte.cl\/wp-content\/uploads\/2024\/09\/favicon-original.png","contentUrl":"https:\/\/blog.databyte.cl\/wp-content\/uploads\/2024\/09\/favicon-original.png","width":189,"height":62,"caption":"Blog Databyte"},"image":{"@id":"https:\/\/blog.databyte.cl\/#\/schema\/logo\/image\/"}},{"@type":"Person","@id":"https:\/\/blog.databyte.cl\/#\/schema\/person\/bcee33ff0688a37207b3d42f952d50f4","name":"Miguel Carmona","image":{"@type":"ImageObject","inLanguage":"es","@id":"https:\/\/blog.databyte.cl\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/816da46dc6aeebe927a21c8588b82db83c4241fbc978af1ef97060f329310287?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/816da46dc6aeebe927a21c8588b82db83c4241fbc978af1ef97060f329310287?s=96&d=mm&r=g","caption":"Miguel Carmona"},"url":"https:\/\/blog.databyte.cl\/index.php\/author\/mcarmona\/"}]}},"modified_by":"Miguel Carmona","jetpack_featured_media_url":"","jetpack-related-posts":[],"jetpack_sharing_enabled":true,"rttpg_featured_image_url":null,"rttpg_author":{"display_name":"Miguel Carmona","author_link":"https:\/\/blog.databyte.cl\/index.php\/author\/mcarmona\/"},"rttpg_comment":0,"rttpg_category":"<a href=\"https:\/\/blog.databyte.cl\/index.php\/category\/nagios\/\" rel=\"category tag\">Seguridad y Monitoreo<\/a>","rttpg_excerpt":"En este tutorial aprender\u00e1s a detectar accesos fallidos a un equipo con Windows Server (o cualquier Windows que registre eventos de seguridad), espec\u00edficamente los intentos de inicio de sesi\u00f3n fallidos registrados como evento 4625 en el Visor de eventos. Tambi\u00e9n aprender\u00e1s a exportarlos f\u00e1cilmente a un archivo CSV o visualizarlos directamente en pantalla, usando un...&hellip;","_links":{"self":[{"href":"https:\/\/blog.databyte.cl\/index.php\/wp-json\/wp\/v2\/posts\/4904","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.databyte.cl\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.databyte.cl\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.databyte.cl\/index.php\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.databyte.cl\/index.php\/wp-json\/wp\/v2\/comments?post=4904"}],"version-history":[{"count":23,"href":"https:\/\/blog.databyte.cl\/index.php\/wp-json\/wp\/v2\/posts\/4904\/revisions"}],"predecessor-version":[{"id":4931,"href":"https:\/\/blog.databyte.cl\/index.php\/wp-json\/wp\/v2\/posts\/4904\/revisions\/4931"}],"wp:attachment":[{"href":"https:\/\/blog.databyte.cl\/index.php\/wp-json\/wp\/v2\/media?parent=4904"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.databyte.cl\/index.php\/wp-json\/wp\/v2\/categories?post=4904"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.databyte.cl\/index.php\/wp-json\/wp\/v2\/tags?post=4904"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}