Logon,logoff,locking in the event log

From Michael's Information Zone
Revision as of 10:55, 6 February 2018 by Michael.mast (talk | contribs) (Created page with "==Purpose== To record my notes on logging events related to logon, logoff, and locking of Windows systems on a domain. ==Notes== *4624 : All logon types *4634 : An account was...")
(diff) ← Older revision | Latest revision (diff) | Newer revision → (diff)
Jump to navigation Jump to search

Purpose

To record my notes on logging events related to logon, logoff, and locking of Windows systems on a domain.

Notes

  • 4624 : All logon types
  • 4634 : An account was logged off.[1]
  • 4800 : The workstation was locked.[2]
  • 4801 : Workstation was unlocked
  • 4802 : Screen saver was invoked
  • 4803 : Screen saver was dismissed





  1. ↑ https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4634
  2. ↑ https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4800
Retrieved from "https://wiki.1701technology.com/index.php?title=Logon,logoff,locking_in_the_event_log&oldid=612"