Event 4624 and remote desktop Expand / Collapse
Author
Message
Posted 12/12/2016 6:56:30 PM
Forum Newbie

Forum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum Newbie

Group: Forum Members
Last Login: 12/6/2016 6:39:13 PM
Posts: 1, Visits: 0
Hi all

Trying to track logins/logouts in ArcSight SIEM

We have an AD domain and we use a jump host to get around our environment.

When you RDP to the jump host and you then use RDP from the jump host to login to another AD host, I get a logout message from the jump host when I havent actually logged out. Why does AD send a logout message in this instance? How can I monitor logins so I can ignore this false logout?

Thanks in advance
Post #7293
Posted 12/26/2016 4:01:09 PM
Supreme Being

Supreme BeingSupreme BeingSupreme BeingSupreme BeingSupreme BeingSupreme BeingSupreme BeingSupreme Being

Group: Moderators
Last Login: 11/14/2013 3:17:47 PM
Posts: 237, Visits: 0
When you RDP to Server A, and then from Server A you RDP to Server B you get a logout on Server A with the same account? Can you provide some samples?
Post #7300
« Prev Topic | Next Topic »


Permissions Expand / Collapse

All times are GMT -5:00, Time now is 9:25pm