4624 Duplication Expand / Collapse
Author
Message
Posted 2/6/2017 9:32:51 AM
Forum Newbie

Forum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum Newbie

Group: Forum Members
Last Login: 1/31/2017 11:26:45 AM
Posts: 2, Visits: 0
Hello.
Any ideas why Windows generate the same logon event (at least twice)?

I am little bit confused. I see in security log (all time I connected) two totally identical events
Event ID 4624
Type 2

Events are totally the same. The same happens with other events.

For me it is great problem, because I collect this events on remote server (by NXLog) and i see a lot of duplication's

Thank you!


Post #7317
Posted 3/17/2017 7:40:52 AM
Supreme Being

Supreme BeingSupreme BeingSupreme BeingSupreme BeingSupreme BeingSupreme BeingSupreme BeingSupreme Being

Group: Moderators
Last Login: 11/14/2013 3:17:47 PM
Posts: 237, Visits: 0
I have seen this behavior when there is some sort of quthentication integration with things like 2 factor integration. Could that be the case? Where are you seeing these events? On a SIEM, syslog server, or in the event viewer?
Post #7330
« Prev Topic | Next Topic »


Permissions Expand / Collapse

All times are GMT -5:00, Time now is 6:17am