Share via

Windows event log ID 4648 fields- what does “network information” stand for?

Anonymous
2021-03-29T08:27:01+00:00

As per Microsoft docs, 4648 stands for

"This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command."

I am checking through event logs for identifying a security breach, and a 4648 event log is as follows.

A logon was attempted using explicit credentials.

Subject:

Security ID:        SYSTEM

Account Name:       <Removed>

Account Domain:     WORKGROUP

Logon ID:       0x3E7

Logon GUID:     {00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:

Account Name:       Administrator

Account Domain:     <Removed>

Logon GUID:     {00000000-0000-0000-0000-000000000000}

Target Server:

Target Server Name: localhost

Additional Information: localhost

Process Information:

Process ID:     0x1e0f4

Process Name:       C:\Windows\System32\winlogon.exe

Network Information:

Network Address:    12.34.56.78

Port:           12345

"

What does "Network Information" in the log stand for? Documentation was not clear for me and certainly 12.34.56.78 is another machine in the network.

Windows for home | Previous Windows versions | Internet and connectivity

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments No comments

1 answer

Sort by: Most helpful
  1. Reza-Ameri 45,806 Reputation points Volunteer Moderator
    2021-04-02T16:00:04+00:00

    Is this PC part of domain or company's network?

    Try open start and search for cmd and open it and type:

    ping 12.34.56.78 

    (the IP you shared)

    And see if it response?

    Do you recognize the second Account Domain name?

    0 comments No comments