4624 logged in DC Expand / Collapse
Author
Message
Posted 9/17/2018 4:56:18 AM
Forum Newbie

Forum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum Newbie

Group: Forum Members
Last Login: 9/17/2018 4:46:21 AM
Posts: 1, Visits: 0
Hi, from waht I have read from your book and documentation, event 4624 should be logged only in the local machine which the client tried to login into. The event should not be logged in the DC.

Maybe I am missing something but when inspecting the DC's log I do receive 4624 events of a machine in my domain.

Please help

Thanks
Post #8503
Posted 9/29/2018 7:27:28 PM
Supreme Being

Supreme BeingSupreme BeingSupreme BeingSupreme BeingSupreme BeingSupreme BeingSupreme BeingSupreme Being

Group: Moderators
Last Login: 11/14/2013 3:17:47 PM
Posts: 237, Visits: 0
You will get logon events from hosts to a DC if that host is accessing the DC. Sometimes this is during Group Policy updates especially a type 3 logon. Other times might be for administrative purposes. Take a look at the event and try to determine if either of these cases makes sense.
Post #8508
« Prev Topic | Next Topic »


Permissions Expand / Collapse

All times are GMT -5:00, Time now is 10:50pm