Event 4672 Special Logon
Event ID 4672 This event get logged whenever an account assigned any ‘administrator equivalent’ user rights logs on. For instance …
Logon Audit
Event 4624 null sid – Repeated security log
I have several of security log entries with the event 4624 followed shortly by an event 4634. Since it seams …
Tracking User Logon Activity using Logon and Logoff Events
We can track the user’s Logon Activity using Logon and Logoff Events – (4624, 4634) by mapping logon and logoff event …
Event ID 4625 Failure Codes
Event ID 4625 – This event is generated when a logon request fails. It is generated on the computer where …
Enable Active Directory Logon/Logoff Audit events
Logon/Logoff Audit In Active Directory based domain system, Logon , Logoff, Logon Failures events are controlled by the two security …
Logon and Logoff Events in Active Directory
The user’s logon and logoff events are logged under two categories in Active Directory based environment. These events are controlled …
LastLogon vs LastLogonTimeStamp
Description In this article, I am going to explain the difference between LastLogon vs LastLogonTimeStamp in Active Directory and how …