Share via

Windows Event ID

roozbehr2 20 Reputation points
2023-10-02T06:12:49.3133333+00:00

Hi All,

I am looking for a solution that every user who logings to any of the network clients in Active Directory network will be specified in the Windows logs.

In Windows logs, the Event id 4624 is used for successful login to every machine and client of the network, and in real conditions, a large number of Event id 4624 is created for each user login in every time in two field of logonProcessName (Kerberos,NtLmSsp).

Windows for business Windows Client for IT Pros User experience Other
0 comments
Accepted answer
  1. Anonymous
    2023-10-02T22:01:26.04+00:00

    You can follow along here.

    https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/basic-audit-logon-events

    --please don't forget to close up the thread here by marking answer if the reply is helpful--

2 additional answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. roozbehr2 20 Reputation points
    2023-10-07T06:47:08.4866667+00:00

    At our workplace, a large number of event id 4624 is created for each login

    I am looking for a filter that can specify the login of each user in the network. When each user logs in, a large number of logs with event id 6424 are created for each user in the targetUserName field.

  2. Deleted

    This answer has been deleted due to a violation of our Code of Conduct. The answer was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.

    Comments have been turned off. Learn more

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.