Invalid Code for Multi-Factor Authentication Entered
Sent when a user enters an invalid confirmation code for multi-factor authentication. For more information, see Multi-Factor Authentication.
General Information
Event ID: 40205
Event message details: Invalid MFA code has been entered for <UserName>
Severity: Info
Parameters
Parameter Name | Description | Example |
|---|---|---|
UserName | Name of the user who performed an operation. | UserName="TECH\user1" |
Endpoint | Mobile device where the attempt was detected. | Endpoint="[::1]:52182" |
SID | User security identifier. | SID="S-1-5-21-670747961-1840839389-3357612639-1134" |
VbrHostName | Backup server name. Can be a DNS name, an FQDN or an IP address. | VbrHostName="vbrsrv01.tech.local" |
VbrVersion | Veeam Backup & Replication version. | VbrVersion="12.3.1.1139" |
Version | Event version (service parameter). | Version="1" |
Description | Event message details. | Description="Invalid MFA code has been entered for TECH\user1" |
Syslog Message Example
1 2025-03-24T05:42:34.783406-07:00 VBRSRV01 Veeam_MP - - [origin enterpriseId="31023"] [categoryId=0 instanceId=40205 UserName="TECH\user1" Endpoint="[::1]:52182" SID="S-1-5-21-670747961-1840839389-3357612639-1134" VbrHostName="vbrsrv01.tech.local" VbrVersion="12.3.1.1139" Version="1" Description="Invalid MFA code has been entered for TECH\user1"] |
