Is this PC part of domain or company's network?
Try open start and search for cmd and open it and type:
ping 12.34.56.78
(the IP you shared)
And see if it response?
Do you recognize the second Account Domain name?
This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
As per Microsoft docs, 4648 stands for
"This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command."
I am checking through event logs for identifying a security breach, and a 4648 event log is as follows.
A logon was attempted using explicit credentials.
Subject:
Security ID: SYSTEM
Account Name: <Removed>
Account Domain: WORKGROUP
Logon ID: 0x3E7
Logon GUID: {00000000-0000-0000-0000-000000000000}
Account Whose Credentials Were Used:
Account Name: Administrator
Account Domain: <Removed>
Logon GUID: {00000000-0000-0000-0000-000000000000}
Target Server:
Target Server Name: localhost
Additional Information: localhost
Process Information:
Process ID: 0x1e0f4
Process Name: C:\Windows\System32\winlogon.exe
Network Information:
Network Address: 12.34.56.78
Port: 12345
"
What does "Network Information" in the log stand for? Documentation was not clear for me and certainly 12.34.56.78 is another machine in the network.
Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.
Is this PC part of domain or company's network?
Try open start and search for cmd and open it and type:
ping 12.34.56.78
(the IP you shared)
And see if it response?
Do you recognize the second Account Domain name?