Difference between revisions of "Logon,logoff,locking in the event log"

Revision as of 15:40, 6 February 2018

To record my notes on logging events related to logon, logoff, and locking of Windows systems on a domain.

Initial attempt is made using a DC as the collector as it already had spare storage. ^[1]

Make sure that if you change the directory in which you store the forwarded log file, that permissions are set to allow full control to both the Local Service and Network Service accounts.
You do need to enable WinRM on the collector, in this case I am using a DC which already had it configured.

2 : Interactive - A user logged on to this computer.
3 : Network - A user or computer logged on to this computer from the network.
4 : Batch - Batch logon type is used by batch servers, where processes may be executing on behalf of a user without their direct intervention.
5 : Service - A service was started by the Service Control Manager.
7 : Unlock - This workstation was unlocked.
8 : NetworkCleartext - A user logged on to this computer from the network. The user's password was passed to the authentication package in its unhashed form.
9 : NewCredentials - A caller cloned its current token and specified new credentials for outbound connections.
10 : RemoteInteractive - A user logged on to this computer remotely using Terminal Services or Remote Desktop.
11 : CachedInteractive - A user logged on to this computer with network credentials that were stored locally on the computer.

4624

Subject
- 1 = Account name
- 2 = Account Domain
- 3 = Logon ID
New Logon
- 4 = Security ID
- 5 = Account Name
- 6 = Account Domain
- 7 = Logon ID
- 12 = Logon GUID
Logon Type
- 8 = Logon Type
Detailed Authentication Information
- 9 = Logon Process
- 10 = Authentication Package
Network Information
- 11 = Workstation Name
- 14 = Key Length
- 18 = Source Network Address
- 19 = Source Port
Process Information
- 16 = Process ID
- 17 = Process Name

@@ Line 10: / Line 10: @@
 ===EventIDs===
-get-eventlog -logname 'Security' -InstanceID 4624 | select -Last 4 @{Label="value";Expression={$_.replacementStrings[5]}}
 *4624 : All logon types
 *4634 : An account was logged off.<ref>https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4634</ref>