551 SMB Auth Failed

Win 2019 Server - SMB Session Authentication Failure - Event ID 551 - Microsoft Q&AMicrosoftLearn

Log Location:

• Microsoft\Windows\SMBServer\Security

Considerations:

• This event is logged by default

• Can be used to hunt for failed authentication attempts over SMB.