Windows event logs are collected via the Windows Event Log API.The table describes the Windows event logs monitored by Logon Tracker. The “LT Assigned Status” column reflects the status that Logon Tracker assigns to each event. These statuses are relevant to the module configuration (see Configuring Logon Tracker Agent Policy) and the UI search functionality (see Search Controls.
Note
Always review your domain audit policy to ensure that success and failure logon events are being audited. For example, default policies that exclude auditing of successful logons, will drastically reduce the value of Logon Tracker.
Windows Event Log | EID | LT Assigned Status | Description |
|---|---|---|---|
Security | 4624 | SUCCESS | Successful logon. |
Security | 4672 | N/A | 4672 events are generated by Windows immediately following a successful logon (4624) by a privileged account such as a local administrator or domain admin. Logon Tracker annotates successful logon events (4624) as “privileged”. This annotation is used to enable a UI feature to search for privileged account logons. |
Microsoft-Windows- TerminalServices- LocalSessionManag er/Operational | 21 | SUCCESS | Successful RDP logon. |
Microsoft-Windows- TerminalServices- LocalSessionManag er/Operational | 25 | SUCCESS | Remote Desktop Services: Session reconnection succeeded |
Security | 4625 | FAILED | A failed logon, RDP or otherwise. |
Security | 4648 | UNKNOWN | An attempt to log into a remote system. The events have a status of UNKNOWN because Windows does not capture the result of the attempt (success or failure) on the source system. Regardless, the attempt itself is relevant when investigating lateral movement. |
Security | 5145 | UNKNOWN | An attempt to access a network share. This indicates that an access check was performed prior to a user connecting to the share. |