Understanding Event ID 4624

Question

Understanding Event ID 4624

Anonymous

Hi All;

Trying to understand the Event ID 4624. I found a very informative article on the MS Learn website. However, the Process ID in Event Viewer shows 0x4c8. The Decimal value shows 1224. When I look at Task Manager there is no 1224 PID. The closest POD is 1244?

Thanks

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments

4 answers

Answer 1

Anonymous

Amos;

Thanks, was trying to run a search to find other articles from the author. However, ended getting lost in the search. Will pursue when I have more time.

Thank you

dw

0 comments

Answer 2

Hello Westdr1dw，

Thank you for your elaboration, again finding PID 1224 could be the program getting a new PID again which is 1224, I am glad that your problem is solved, for the document you are talking about it is written and maintained by the Microsoft Documentation team, the contributor is the user in the image below, you can express your thanks to that author.

Thank you for recognizing and supporting Microsoft's documentation, and if you have any further questions please continue to come to the Microsoft community.

Best Wish!

Amos.L- MSFT | Microsoft Community Support Specialist

Answer 3

Amos;

Thanks, not sure what happened yesterday morning. The first thing I usually do when logging on is open EV and look for any errors/warnings and Security Log. Yesterday was not able to find PID 1224 in the Services running. However, this morning it was there. Thanks for the link, however, I read the article yesterday morning which piqued my curosity and prompted the email. One of the better articles I have read on the topic. Kudos to the writer for keeping it simple.

Thanks

Answer 4

Hello Westdr1dw,

Welcome to the Microsoft Community.

Thank you for your feedback. Based on your description, your event ID 4624 shows PID 1224, but you are unable to find this PID. This might be because process IDs (PIDs) are dynamically assigned, and each time a process starts, it gets a new PID. It is possible that you closed or restarted the application with PID 1224, which is why you cannot find this ID.

If you want to learn more about event ID 4624, you can check the following link:

4624(S) An account was successfully logged on. - Windows 10 | Microsoft Learn

I hope this information helps you. If you have any further questions or need additional assistance, please feel free to reply. I am happy to continue helping you.Thank you for visiting the Microsoft Community. Wishing you good health and a pleasant day!

Best wishes!

Amos.L - MSFT | Microsoft Community Support Specialist

Share via

Understanding Event ID 4624

4 answers