[Forum FAQ] Introduce three common parameters of Logon Events
there lots of threads querying logon events. in article, introduce simple efficient ways better understand user logon events.
logon type
logon type concise parameter can determine , how logon events triggered.
windows system has 13 logon types, each 1 documented in article below:
please note interactive logon can generated both locally , remotely through terminal services/remote desktop services. logon attempts through terminal services/remote desktop services logged remote interactive logon, logon type 10.
may confuse network logon (logon type 3) remote interactive logon.
in fact, network logon provides network access destination computer while interactive logon enables users ability of interacting applications on destination computer after logged on.
way distinguish interactive , network logon interactive logon requires users input credentials during logon process, can see event id 4648 “a logon attempted using explicit credentials” (figure 1) every interactive logon, network logon doesn’t require explicit credentials.
figure 1: event 4648
design provide better user experience, don’t need input credentials repeatedly when accessing network resources after logged on. in addition, part of reasons why there countless logon/logoff events in event logs.
figure 2 , figure 3 remote interactive logon , network logon event.
figure 2: network logon
figure 3: remote interactive logon
account domain (target domain name)
can distinguish local , domain logon events information of account domain (target domain name).
section doesn’t show domain name, in events of local logons, local workstation names displayed @ section, figure 4 , figure 5 example of local logon event.
figure 4: account domain
figure 5: target domain name
Windows Server > Security
Comments
Post a Comment