4624 - Update logon types Expand / Collapse
Author
Message
Posted 5/15/2018 5:53:31 AM
Forum Newbie

Forum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum Newbie

Group: Forum Members
Last Login: 5/15/2018 5:45:48 AM
Posts: 1, Visits: 0
There are three additional logon types not covered by your article:
0 - SYSTEM reserved
12 - Cached Interactive
13 - Workstation logon
info from https://msdn.microsoft.com/en-us/library/aa394189.aspx
Post #7475
Posted 6/11/2018 4:06:23 PM
Supreme Being

Supreme BeingSupreme BeingSupreme BeingSupreme BeingSupreme BeingSupreme BeingSupreme BeingSupreme Being

Group: Moderators
Last Login: 11/14/2013 3:17:47 PM
Posts: 201, Visits: 0
We'll take a look. Those may be reserved and never used Logon ID's. https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4624 states the exact same logon types as https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4624. If you find a sample then maybe we should add it.
Post #7480
« Prev Topic | Next Topic »


Permissions Expand / Collapse

All times are GMT -5:00, Time now is 9:29pm