Domain Logon Event Id

This event is generated on the computer that was accessed in other words where the logon session was created.

Domain logon event id. The logon type specifies whether the logon session is interactive remote desktop network based i e. Event id 4776 is logged whenever a domain controller dc attempts to validate the credentials of an account using ntlm over kerberos. Starting from windows server 2008 and up to windows server 2016 the event id for a user logon event is 4624. Incoming connection to shared folder a batch job e g.

Let s discuss interactive logons first. Let s use an example to get a better understanding. Microsoft active directory stores user logon history data in the event logs on domain controllers. For example if the user admin logon at the time 10 am we will get the following logon event.

You can see an example of an event viewer user logon event id and logoff with the same logon id below. A related event event id 4625 documents failed logon attempts. This event identifies the user who just logged on the logon type and the logon id. These events contain data about the user time computer and type of user logon.

Windows server 2008 r2 and windows 7 windows server 2012 r2 and windows 8 1 and windows server 2016 and windows. And if he logoff the system at the time 6 pm we will get the logoff event either 4634 or 4647 interactive and remoteinteractive remote desktop logons with the same logon id 0x24f6. Event 4624 applies to the following operating systems. Scheduled task or a service logon triggered by a service logging on.

4624 with logon id like 0x24f6. This event is also logged for logon attempts to the local sam account in workstations and windows servers as ntlm is the default authentication mechanism for local logon. In the event properties given above a user with the account name testuser1 had logged in on 11 24 2017 at 2 41 pm. Login event id in event view in this example the lab administrator account had logged in id 4624 on 8 27 2015 at 5 28pm with a logon id of 0x146ff6.

If a local sam account there will be a corresponding failure event from the account logon category. Double click the event id 4648 to access event properties. The session start time is displayed as logged. User logon event properties.