question

ioannistsaklidis-5344 avatar image
0 Votes"
ioannistsaklidis-5344 asked DSPatrick edited

Are logon/logoff events from computers in the domain forwarded to domain controllers?

If a user logs on or off a computer that has joined a domain , we can see in the security logs of the computer that a logon or logoff event has been generated.
Do these events get forwarded to Domain Controllers of the domain that the computer belongs to ?

windows-server
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

1 Answer

DSPatrick avatar image
0 Votes"
DSPatrick answered DSPatrick edited

No, they wouldn't be captured on domain controller.
This subcategory typically generates huge amount of “4634(S): An account was logged off.” events, which typically have little security relevance.
https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/audit-logoff

--please don't forget to upvote and Accept as answer if the reply is helpful--





5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.