Reading Logon Events

Who signed in, from where, how and with what rights, read from 4624 in the Security log.

  • Reading the Evidence

Why It Matters

Most attacks that reuse credentials first show as a logon that does not fit its account, such as the wrong machine, the wrong protocol or the wrong logon type. Reading each field for what it records is how you see it.

What Happens

Start with Logon Type in event 4624 in the Security log, which says how the session began and so what it may have left behind. Then read the account and its domain, where a machine name means a local account, and Workstation Name and Source Network Address for where it came from. Authentication Package says how it was proved, by Kerberos, NTLM or Negotiate.

Which network fields are filled depends on the protocol and the service, so an empty one proves nothing alone. For NTLM, Workstation Name is what the client claimed and Source Network Address is where the connection came from. When the two disagree, find out why.

Package Name (NTLM only) shows NTLM V1, NTLM V2 or LM, and anything but NTLM V2 is a weakness to fix. Elevated Token Yes marks an administrator session, with event 4672 beside it in the same log listing the special privileges. Expect many logons from SYSTEM, LOCAL SERVICE, NETWORK SERVICE, ANONYMOUS LOGON and computer accounts (names ending in $), and learn their normal pattern before filtering, because a computer account signing in somewhere new can matter.

Logon ID ties a session's events together on one machine until it restarts. Event 4624 opens the session, 4647 shows a user logging off and 4634 closes it, all in the Security log, though logoffs are not always written. Linked Logon ID pairs the two sessions an administrator's interactive sign-in gets under User Account Control, one full and one filtered.

Impersonation Level says how far a server may act as the user, and Delegation means on other machines too. Restricted Admin Mode, filled only for Remote Desktop, says whether the admin's credentials stayed off the server. Disconnecting a Remote Desktop session writes event 4779 to the Security log and reconnecting writes 4778, each with Client Name and Client Address, and a disconnected session keeps its credentials until it ends.

Logon Types

Logon Type in events 4624 and 4625 in the Security log says how a session began. Each value below is the number Windows writes, with its name and what it means on the machine.

Logon TypeNameWhat Happened
2InteractiveA user signed in at the machine, or through RunAs
3NetworkA user or computer reached the machine over the network, such as a share, remote management or PowerShell remoting
4BatchA scheduled task ran as an account
5ServiceThe Service Control Manager started a service as an account
7UnlockA locked session was unlocked
8NetworkCleartextA network logon that handed over the password itself, as CredSSP and IIS Basic authentication do
9NewCredentialsA process kept its own identity locally but used other credentials on the network
10RemoteInteractiveRemote Desktop
11CachedInteractiveA user signed in with cached credentials, and no domain controller was asked
12CachedRemoteInteractiveThe same as RemoteInteractive, recorded this way for internal auditing
13CachedUnlockAn attempt to unlock a workstation

Status and Sub Status in Event 4625

When a logon fails, event 4625 in the Security log gives the reason as a code in Status and Sub Status. Read Sub Status whenever Status is the general 0xC000006D.

CodeMeaning
0xC0000064The user name does not exist
0xC000006AThe user name exists but the password is wrong
0xC000006DA bad user name or bad authentication information, with Sub Status giving the detail
0xC000006FOutside the hours the account may sign in
0xC0000070From a workstation the account may not use
0xC0000072The account is disabled
0xC0000193The account has expired
0xC0000234The account is locked out
0xC000015BThe account lacks the right to this logon type on this machine

What Is Logged

Each event below names the log it is written to, the machine that writes it and the audit setting that switches it on, then what to read in it for this page.

Event and LogWritten OnSwitch It OnWhat It Tells You
4624 An account was successfully logged on (opens in a new tab) Security logThe computer that was logged on toAudit LogonRead Logon Type, the account, Workstation Name, Source Network Address, Authentication Package, Elevated Token and Logon ID together.
4625 An account failed to log on (opens in a new tab) Security logThe computer where the logon was attemptedAudit Logon, and Audit Account Lockout for a locked-out accountStatus and Sub Status give the reason. One source failing across many names, or one name failing from many sources, points to password guessing.
4672 Special privileges assigned to new logon (opens in a new tab) Security logThe computer that was logged on toAudit Special LogonThe new session was given sensitive privileges, listed in Privileges. Every SYSTEM logon writes one too, which is normal.
4634 An account was logged off (opens in a new tab) Security logThe computer the session was onAudit LogoffThe session closed. Pair it with its 4624 in the same log by Logon ID to see how long the session lasted, knowing logoffs can be missing.
4647 User initiated logoff (opens in a new tab) Security logThe computer the user logged off fromAudit LogoffA user chose to log off an interactive or Remote Desktop session, and a 4634 in the same log usually follows.
4778 A session was reconnected to a Window Station (opens in a new tab) Security logThe computer the session is onAudit Other Logon/Logoff EventsA Remote Desktop session reconnected, and Client Name and Client Address say from where.
4779 A session was disconnected from a Window Station (opens in a new tab) Security logThe computer the session is onAudit Other Logon/Logoff EventsA Remote Desktop session disconnected but stayed open, credentials and all.

Check It on a Machine

These Windows Registry keys hold the settings this page names. Open one to see where it lives and how to read it on a machine.

Attacks That Hook in Here

These attacks work through what this page describes. Each card says what the attack is and, where it uses one of these steps, what it does there.

  • Password Spraying

    One guessed password tried against many accounts, over Kerberos and NTLM.

  • NTLM Relay

    Passes a victim's NTLM sign-in to another server and keeps the session it opens.

  • Pass-the-Hash

    Signs in over NTLM with a stolen NT hash, never needing the password.

  • LSASS Memory Theft

    Reads the hashes and tickets that sign-ins left on a machine out of LSASS memory.

  • Clearing and Silencing Logs

    Clears a log or switches a channel off, so the record of what happened is gone.

Hunt It

Each tool below runs the same search. Its note names the log or table it reads and what has to be switched on or collected first.

Sees Related ActivityDeviceLogonEvents (documentation, opens in a new tab)

Reads the DeviceLogonEvents table in Defender XDR advanced hunting, from devices onboarded to Defender for Endpoint, for each Remote Desktop logon with its source and whether the account is a local admin. The table documents no column for Restricted Admin Mode or for reconnects, so read events 4624, 4778 and 4779 in the Security log for those.

KQLDefender XDR, Advanced hunting
// Remote Desktop logons, with the source and local admin rightsDeviceLogonEvents| where Timestamp > ago(30d)| where LogonType == "RemoteInteractive"| project Timestamp, DeviceName, ActionType, AccountDomain, AccountName, RemoteIP, RemoteDeviceName, IsLocalAdmin, LogonId| order by DeviceName asc, Timestamp asc

Sources