Source for 4624 Logon Type 3 - Kerberos Expand / Collapse
Author
Message
Posted 3/22/2019 4:15:30 AM
Forum Newbie

Forum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum Newbie

Group: Forum Members
Last Login: 7/23/2013 7:38:49 PM
Posts: 1, Visits: 0
Hi,
we are eleminating usage of non personated accounts and a view logon Events are still occuring. In my case the successful logon 4624 with type 3 and the process Kerberos is logged. I can see the verification request is gone to our Domain Controller, I can of course see the account Name, but not the System who is starting the process.
The source host Name is given, but there is nothing running with that account. So I assume that a different System tries to Access a resource on that source host via a Kerberos ticket. But there is no hint to that accessing System.
Is there a chain of Events that could uncover the System requesting the ticket?
Do I missunderstand the idea of logon type 3?

I appreciate your comments

Kind regards
Karl-Heinz
Post #8554
Posted 6/24/2019 2:12:35 PM
Supreme Being

Supreme BeingSupreme BeingSupreme BeingSupreme BeingSupreme BeingSupreme BeingSupreme BeingSupreme Being

Group: Moderators
Last Login: 11/14/2013 3:17:47 PM
Posts: 234, Visits: 0
Can you paste some sample events with redacted content? If you are seeing 4624 events then the logins are successful. Can you simply disable or delete the user account?
Post #8572
« Prev Topic | Next Topic »


Permissions Expand / Collapse

All times are GMT -5:00, Time now is 3:31am