server2022服务器没有人使用的时候有很多4624和4672登录日志是什么操作的呢？

Question

每天不定时都有出现。

Answer 1

Hello，天宇晨

The logging logs for events 4624 and 4672 appear frequently, with the following possible causes

1.Many system services run periodically and require authentication. These services use the system account to log on, which generates event IDs 4624 (successful login) and 4672 (assignment of special privileges)

2.If scheduled tasks are configured on the server, these tasks also generate login events when they are executed.

3.Certain network activities or connection requests may trigger login events. For example, access to remote management tools or monitoring software.

4.The automatic update process of a system or application may also generate these login events.

Best Regards，

Chengxili