LogonType 3 MMC.EXE ProcessName Expand / Collapse
Author
Message
Posted 5/5/2018 11:46:29 AM
Forum Newbie

Forum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum Newbie

Group: Forum Members
Last Login: 11/13/2017 9:14:28 AM
Posts: 1, Visits: 0
Can someone tell me what is going on with these event logs?

TargetUserName john
SubjectUserName bill
ProcessName mmc.exe
Type 3
event_id 4625
Process Authz
Workstation IOSLTDCBILL

TargetUserName john
SubjectUserName bill
ProcessName mmc.exe
Type 3
event_id 4624
Process Authz
Workstation IOSLTDCBILL

TargetUserName john
SubjectUserName bill
ProcessName mmc.exe
Type 3
event_id 4648
Process
Workstation

TargetUserName mark
SubjectUserName hank
ProcessName mmc.exe
Type 3
event_id 4625
Process Authz
Workstation IOSLTWSHANK

TargetUserName mark
SubjectUserName hank
ProcessName mmc.exe
Type 3
event_id 4624
Process Authz
Workstation IOSLTWSHANK

TargetUserName mark
SubjectUserName hank
ProcessName mmc.exe
Type 3
event_id 4648
Process
Workstation


(Obviously, I changed the names of everything) Are john and mark using the mmc console to access IOSLTDCBILL and IOSLTWSHANK?


***Needs to be a better way to post logs on here.


  Post Attachments 
example.jpg (1 view, 63.72 KB)
Post #7471
Posted 5/8/2018 6:19:34 PM
Supreme Being

Supreme BeingSupreme BeingSupreme BeingSupreme BeingSupreme BeingSupreme BeingSupreme BeingSupreme Being

Group: Moderators
Last Login: 11/14/2013 3:17:47 PM
Posts: 237, Visits: 0
Can you copy all of the event info? I don't see a target account for 4625 and I don't see source network address..
Post #7473
« Prev Topic | Next Topic »


Permissions Expand / Collapse

All times are GMT -5:00, Time now is 11:23pm