Source for 4624 Logon Type 3 - Kerberos Expand / Collapse
Author
Message
Posted 3/22/2019 4:15:30 AM
Forum Newbie

Forum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum Newbie

Group: Forum Members
Last Login: 7/23/2013 7:38:49 PM
Posts: 1, Visits: 0
Hi,
we are eleminating usage of non personated accounts and a view logon Events are still occuring. In my case the successful logon 4624 with type 3 and the process Kerberos is logged. I can see the verification request is gone to our Domain Controller, I can of course see the account Name, but not the System who is starting the process.
The source host Name is given, but there is nothing running with that account. So I assume that a different System tries to Access a resource on that source host via a Kerberos ticket. But there is no hint to that accessing System.
Is there a chain of Events that could uncover the System requesting the ticket?
Do I missunderstand the idea of logon type 3?

I appreciate your comments

Kind regards
Karl-Heinz
Post #8554
« Prev Topic | Next Topic »


Permissions Expand / Collapse

All times are GMT -5:00, Time now is 4:52am