{"id":53712,"date":"2023-09-16T09:30:00","date_gmt":"2023-09-16T09:30:00","guid":{"rendered":"https:\/\/infrasos.com\/?p=53712"},"modified":"2023-09-15T14:16:42","modified_gmt":"2023-09-15T14:16:42","slug":"what-is-windows-event-id-4624-successful-logon-2","status":"publish","type":"post","link":"https:\/\/infrasos.com\/what-is-windows-event-id-4624-successful-logon-2\/","title":{"rendered":"What is Windows Event ID 4624 ? \u2013 Successful Logon"},"content":{"rendered":"\t\t<div data-elementor-type=\"wp-post\" data-elementor-id=\"53712\" class=\"elementor elementor-53712\">\n\t\t\t\t\t\t\t<div class=\"elementor-element elementor-element-a46f27f e-con-boxed e-con\" data-id=\"a46f27f\" data-element_type=\"container\" data-settings=\"{&quot;content_width&quot;:&quot;boxed&quot;}\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-deb0024 elementor-widget elementor-widget-text-editor\" data-id=\"deb0024\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<style>\/*! elementor - v3.12.2 - 23-04-2023 *\/\n.elementor-widget-text-editor.elementor-drop-cap-view-stacked .elementor-drop-cap{background-color:#69727d;color:#fff}.elementor-widget-text-editor.elementor-drop-cap-view-framed .elementor-drop-cap{color:#69727d;border:3px solid;background-color:transparent}.elementor-widget-text-editor:not(.elementor-drop-cap-view-default) .elementor-drop-cap{margin-top:8px}.elementor-widget-text-editor:not(.elementor-drop-cap-view-default) .elementor-drop-cap-letter{width:1em;height:1em}.elementor-widget-text-editor .elementor-drop-cap{float:left;text-align:center;line-height:1;font-size:50px}.elementor-widget-text-editor .elementor-drop-cap-letter{display:inline-block}<\/style>\t\t\t\t<p>What is Windows Event ID 4624 ? \u2013 Successful Logon. Windows Event ID 4624, often called Successful Logon event, is a pivotal component of <a href=\"https:\/\/infrasos.com\/windows-server-security-best-practices-secure-your-windows-server-environment\/\">Windows Security Event Logs<\/a> that is an integral tool for monitoring and securing computer systems. This event code is system generated. Whenever a user successfully logs into a Windows based system, providing crucial insights into <a href=\"https:\/\/infrasos.com\/active-directory-reporting\/user-reports\/\">user activities<\/a> and<a href=\"https:\/\/infrasos.com\/azure-ad-role-based-access-control-best-practices-how-to-use-azure-ad-roles-and-privileges-effectively\/\"> access privileges<\/a>. By examining Event ID 4624 and its associated details, cybersecurity professionals understand who has gained access to a system, when it occurred, and from which source. This information is invaluable for promptly <a href=\"https:\/\/infrasos.com\/the-role-of-threat-intelligence-in-active-directory-security\/\">identifying and responding to security threats<\/a> and maintaining the integrity and security of an organization&#8217;s digital environment.<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-bb3ddfe e-con-boxed e-con\" data-id=\"bb3ddfe\" data-element_type=\"container\" data-settings=\"{&quot;content_width&quot;:&quot;boxed&quot;}\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-b77c349 elementor-widget elementor-widget-text-editor\" data-id=\"b77c349\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>Shall we start What is Windows Event ID 4624 ? \u2013 Successful Logon.<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-a472197 elementor-widget elementor-widget-text-editor\" data-id=\"a472197\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p><span style=\"color: #ff6600;\"><strong>Also Read\u00a0<a href=\"https:\/\/infrasos.com\/configure-and-manage-windows-firewall-for-your-windows-server\/\">Configure and Manage Windows Firewall for Your Windows Server<\/a><\/strong><\/span><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-f4cb95e elementor-widget elementor-widget-heading\" data-id=\"f4cb95e\" data-element_type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<style>\/*! elementor - v3.12.2 - 23-04-2023 *\/\n.elementor-heading-title{padding:0;margin:0;line-height:1}.elementor-widget-heading .elementor-heading-title[class*=elementor-size-]>a{color:inherit;font-size:inherit;line-height:inherit}.elementor-widget-heading .elementor-heading-title.elementor-size-small{font-size:15px}.elementor-widget-heading .elementor-heading-title.elementor-size-medium{font-size:19px}.elementor-widget-heading .elementor-heading-title.elementor-size-large{font-size:29px}.elementor-widget-heading .elementor-heading-title.elementor-size-xl{font-size:39px}.elementor-widget-heading .elementor-heading-title.elementor-size-xxl{font-size:59px}<\/style><h2 class=\"elementor-heading-title elementor-size-default\">What is Windows Event ID 4624 ? \u2013 Successful Logon<\/h2>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-7acd5ef e-con-boxed e-con\" data-id=\"7acd5ef\" data-element_type=\"container\" data-settings=\"{&quot;content_width&quot;:&quot;boxed&quot;}\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-a2cd253 elementor-widget elementor-widget-image\" data-id=\"a2cd253\" data-element_type=\"widget\" data-widget_type=\"image.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<style>\/*! elementor - v3.12.2 - 23-04-2023 *\/\n.elementor-widget-image{text-align:center}.elementor-widget-image a{display:inline-block}.elementor-widget-image a img[src$=\".svg\"]{width:48px}.elementor-widget-image img{vertical-align:middle;display:inline-block}<\/style>\t\t\t\t\t\t\t\t\t\t\t\t\t<a href=\"https:\/\/infrasos.com\/wp-content\/uploads\/2023\/09\/Untitled-2-1.png\" data-elementor-open-lightbox=\"yes\" data-elementor-lightbox-title=\"What is Windows Event ID 4624 ? \u2013 Successful Logon\" data-e-action-hash=\"#elementor-action%3Aaction%3Dlightbox%26settings%3DeyJpZCI6NTM3NzcsInVybCI6Imh0dHBzOlwvXC9pbmZyYXNvcy5jb21cL3dwLWNvbnRlbnRcL3VwbG9hZHNcLzIwMjNcLzA5XC9VbnRpdGxlZC0yLTEucG5nIn0%3D\">\n\t\t\t\t\t\t\t<img decoding=\"async\" src=\"https:\/\/infrasos.com\/wp-content\/uploads\/elementor\/thumbs\/Untitled-2-1-qc5aff6h1jh7oxgjbtqfdmh02uojeqrtt08b9pa1zq.png\" title=\"What is Windows Event ID 4624 ? \u2013 Successful Logon\" alt=\"What is Windows Event ID 4624 ? \u2013 Successful Logon\" loading=\"lazy\" \/>\t\t\t\t\t\t\t\t<\/a>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-18ea3f8 e-con-boxed e-con\" data-id=\"18ea3f8\" data-element_type=\"container\" data-settings=\"{&quot;content_width&quot;:&quot;boxed&quot;}\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-7cb69e3 elementor-widget elementor-widget-text-editor\" data-id=\"7cb69e3\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>Every successful attempt to <a href=\"https:\/\/infrasos.com\/create-active-directory-logon-reports-with-powershell\/\">log on to a local computer<\/a> is recorded by <a href=\"https:\/\/learn.microsoft.com\/en-us\/windows\/security\/threat-protection\/auditing\/event-4624\" target=\"_blank\" rel=\"noopener\">Event ID 4624<\/a>, which we see in Windows Event Viewer. In other words, where the system establishes an event, the system generates the event on the computer access. <a href=\"https:\/\/infrasos.com\/what-is-event-id-4625-an-account-failed-to-log-on\/\">Event ID 4625<\/a> records failed logon attempts in a connected incident.<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-170fd85 e-con-boxed e-con\" data-id=\"170fd85\" data-element_type=\"container\" data-settings=\"{&quot;content_width&quot;:&quot;boxed&quot;}\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-5deaa1f elementor-widget elementor-widget-text-editor\" data-id=\"5deaa1f\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p><span style=\"color: #ff6600;\"><strong>Also Read\u00a0<a href=\"https:\/\/infrasos.com\/what-is-windows-event-log-id-4740-a-user-account-was-locked-out\/\">What is Windows Event Log ID 4740? \u2013 A User Account Was Locked Out<\/a><\/strong><\/span><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-8063c0e elementor-widget elementor-widget-heading\" data-id=\"8063c0e\" data-element_type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">Overview of Event Fields<\/h2>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-16b5669 e-con-boxed e-con\" data-id=\"16b5669\" data-element_type=\"container\" data-settings=\"{&quot;content_width&quot;:&quot;boxed&quot;}\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-f940cb6 elementor-widget elementor-widget-image\" data-id=\"f940cb6\" data-element_type=\"widget\" data-widget_type=\"image.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<a href=\"https:\/\/infrasos.com\/wp-content\/uploads\/2023\/09\/event-4624-windows-2016-screenshot.png\" data-elementor-open-lightbox=\"yes\" data-elementor-lightbox-title=\"event id 4624 example\" data-e-action-hash=\"#elementor-action%3Aaction%3Dlightbox%26settings%3DeyJpZCI6NTM3NjcsInVybCI6Imh0dHBzOlwvXC9pbmZyYXNvcy5jb21cL3dwLWNvbnRlbnRcL3VwbG9hZHNcLzIwMjNcLzA5XC9ldmVudC00NjI0LXdpbmRvd3MtMjAxNi1zY3JlZW5zaG90LnBuZyJ9\">\n\t\t\t\t\t\t\t<img loading=\"lazy\" decoding=\"async\" width=\"425\" height=\"649\" src=\"https:\/\/infrasos.com\/wp-content\/uploads\/2023\/09\/event-4624-windows-2016-screenshot.png\" class=\"attachment-medium_large size-medium_large wp-image-53767\" alt=\"event id 4624 example\" srcset=\"https:\/\/infrasos.com\/wp-content\/uploads\/2023\/09\/event-4624-windows-2016-screenshot.png 425w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/09\/event-4624-windows-2016-screenshot-196x300.png 196w\" sizes=\"(max-width: 425px) 100vw, 425px\" \/>\t\t\t\t\t\t\t\t<\/a>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-c2278fd elementor-widget elementor-widget-text-editor\" data-id=\"c2278fd\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p><span data-preserver-spaces=\"true\">\u00a0The\u00a0<\/span><strong><span data-preserver-spaces=\"true\">vital information<\/span><\/strong><span data-preserver-spaces=\"true\"> that we derive from Event 4624 includes:<\/span><\/p><ul><li><strong><span data-preserver-spaces=\"true\">Logon Type:<\/span><\/strong><span data-preserver-spaces=\"true\">\u00a0This field discloses the user login method, highlighting <a href=\"https:\/\/infrasos.com\/active-directory-reporting\/user-reports\/logon-logoff-report\/\">how the user accessed the system<\/a>. Among the nine logon types, the most prevalent are logon type 2 (interactive) and type 3 (network), while any logon type other than 5 (indicating a service startup) should raise concerns. Further elaboration on logon types follows later in the article.<\/span><\/li><li><strong><span data-preserver-spaces=\"true\">New Logon:<\/span><\/strong><span data-preserver-spaces=\"true\">\u00a0In this segment, we uncover the Account Name associated with each new logon created by the system, along with the corresponding Logon ID, a hexadecimal value that aids in cross-referencing this event with others.<\/span><\/li><\/ul>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-b8debd9 e-con-boxed e-con\" data-id=\"b8debd9\" data-element_type=\"container\" data-settings=\"{&quot;content_width&quot;:&quot;boxed&quot;}\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-ebb6a5c elementor-widget elementor-widget-heading\" data-id=\"ebb6a5c\" data-element_type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h3 class=\"elementor-heading-title elementor-size-default\">Other Information From Event ID 4624<\/h3>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-cbcc620 e-con-boxed e-con\" data-id=\"cbcc620\" data-element_type=\"container\" data-settings=\"{&quot;content_width&quot;:&quot;boxed&quot;}\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-a2fb8a9 elementor-widget elementor-widget-text-editor\" data-id=\"a2fb8a9\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<ul><li><strong><span data-preserver-spaces=\"true\">Subject:<\/span><\/strong><span data-preserver-spaces=\"true\"> Discloses the account on the local system (not the user) that initiated the logon request.<\/span><\/li><li><strong><span data-preserver-spaces=\"true\">Impersonation Level:<\/span><\/strong><span data-preserver-spaces=\"true\"> This section indicates how a process within the logon session impersonates a client, influencing the operations a server performs within the client&#8217;s context.<\/span><\/li><li><strong><span data-preserver-spaces=\"true\">Process Information:<\/span><\/strong><span data-preserver-spaces=\"true\"> Details regarding the process that made the logon attempt.<\/span><\/li><li><strong><span data-preserver-spaces=\"true\">Network Information:<\/span><\/strong><span data-preserver-spaces=\"true\"> Reveals the location from which the user logged on. In the case of a user-initiated <a href=\"https:\/\/infrasos.com\/create-active-directory-computer-reports-with-powershell\/\">logon from the same computer<\/a>, this information may be empty or display the local computer&#8217;s workstation name and source network address.<\/span><\/li><li><strong><span data-preserver-spaces=\"true\">Authentication Information:<\/span><\/strong><span data-preserver-spaces=\"true\"> Information about the authentication package utilized for the logon process.<\/span><\/li><\/ul>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<section class=\"elementor-section elementor-inner-section elementor-element elementor-element-23126705 ot-traditional elementor-section-boxed elementor-section-height-default elementor-section-height-default elementor-invisible\" data-id=\"23126705\" data-element_type=\"section\" data-settings=\"{&quot;animation&quot;:&quot;bounceInRight&quot;,&quot;background_background&quot;:&quot;gradient&quot;}\">\n\t\t\t\t\t\t\t<div class=\"elementor-background-overlay\"><\/div>\n\t\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-50 elementor-inner-column elementor-element elementor-element-6657b1c4 ot-flex-column-vertical\" data-id=\"6657b1c4\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t\t\t<div class=\"elementor-element elementor-element-7008b734 elementor-widget elementor-widget-heading\" data-id=\"7008b734\" data-element_type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h2 class=\"elementor-heading-title elementor-size-large\">Try our Active Directory & Office 365 Reporting & Auditing Tools<\/h2>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-1cebbeb7 elementor-widget elementor-widget-text-editor\" data-id=\"1cebbeb7\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p style=\"text-align: center;\"><strong><span style=\"color: #ff6600;\">Try us out<\/span> for <span style=\"color: #ff0000;\">Free<\/span>.\u00a0 100&#8217;s of report templates available. Easily customise your own reports on AD, Azure AD &amp; Office 355.<\/strong><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t<div class=\"elementor-column elementor-col-50 elementor-inner-column elementor-element elementor-element-52c9be64 ot-flex-column-vertical\" data-id=\"52c9be64\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t\t\t<div class=\"elementor-element elementor-element-6a698fc5 elementor-button-align-center elementor-invisible elementor-widget elementor-widget-global elementor-global-5815 elementor-widget-form\" data-id=\"6a698fc5\" data-element_type=\"widget\" data-settings=\"{&quot;button_width&quot;:&quot;50&quot;,&quot;step_next_label&quot;:&quot;Next&quot;,&quot;step_previous_label&quot;:&quot;Previous&quot;,&quot;_animation&quot;:&quot;pulse&quot;,&quot;step_type&quot;:&quot;none&quot;,&quot;step_icon_shape&quot;:&quot;circle&quot;}\" data-widget_type=\"form.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<style>\/*! elementor-pro - v3.10.3 - 29-01-2023 *\/\n.elementor-button.elementor-hidden,.elementor-hidden{display:none}.e-form__step{width:100%}.e-form__step:not(.elementor-hidden){display:flex;flex-wrap:wrap}.e-form__buttons{flex-wrap:wrap}.e-form__buttons,.e-form__buttons__wrapper{display:flex}.e-form__indicators{display:flex;justify-content:space-between;align-items:center;flex-wrap:nowrap;font-size:13px;margin-bottom:var(--e-form-steps-indicators-spacing)}.e-form__indicators__indicator{display:flex;flex-direction:column;align-items:center;justify-content:center;flex-basis:0;padding:0 var(--e-form-steps-divider-gap)}.e-form__indicators__indicator__progress{width:100%;position:relative;background-color:var(--e-form-steps-indicator-progress-background-color);border-radius:var(--e-form-steps-indicator-progress-border-radius);overflow:hidden}.e-form__indicators__indicator__progress__meter{width:var(--e-form-steps-indicator-progress-meter-width,0);height:var(--e-form-steps-indicator-progress-height);line-height:var(--e-form-steps-indicator-progress-height);padding-right:15px;border-radius:var(--e-form-steps-indicator-progress-border-radius);background-color:var(--e-form-steps-indicator-progress-color);color:var(--e-form-steps-indicator-progress-meter-color);text-align:right;transition:width .1s linear}.e-form__indicators__indicator:first-child{padding-left:0}.e-form__indicators__indicator:last-child{padding-right:0}.e-form__indicators__indicator--state-inactive{color:var(--e-form-steps-indicator-inactive-primary-color,#c2cbd2)}.e-form__indicators__indicator--state-inactive [class*=indicator--shape-]:not(.e-form__indicators__indicator--shape-none){background-color:var(--e-form-steps-indicator-inactive-secondary-color,#fff)}.e-form__indicators__indicator--state-inactive object,.e-form__indicators__indicator--state-inactive svg{fill:var(--e-form-steps-indicator-inactive-primary-color,#c2cbd2)}.e-form__indicators__indicator--state-active{color:var(--e-form-steps-indicator-active-primary-color,#39b54a);border-color:var(--e-form-steps-indicator-active-secondary-color,#fff)}.e-form__indicators__indicator--state-active [class*=indicator--shape-]:not(.e-form__indicators__indicator--shape-none){background-color:var(--e-form-steps-indicator-active-secondary-color,#fff)}.e-form__indicators__indicator--state-active object,.e-form__indicators__indicator--state-active svg{fill:var(--e-form-steps-indicator-active-primary-color,#39b54a)}.e-form__indicators__indicator--state-completed{color:var(--e-form-steps-indicator-completed-secondary-color,#fff)}.e-form__indicators__indicator--state-completed [class*=indicator--shape-]:not(.e-form__indicators__indicator--shape-none){background-color:var(--e-form-steps-indicator-completed-primary-color,#39b54a)}.e-form__indicators__indicator--state-completed .e-form__indicators__indicator__label{color:var(--e-form-steps-indicator-completed-primary-color,#39b54a)}.e-form__indicators__indicator--state-completed .e-form__indicators__indicator--shape-none{color:var(--e-form-steps-indicator-completed-primary-color,#39b54a);background-color:initial}.e-form__indicators__indicator--state-completed object,.e-form__indicators__indicator--state-completed svg{fill:var(--e-form-steps-indicator-completed-secondary-color,#fff)}.e-form__indicators__indicator__icon{width:var(--e-form-steps-indicator-padding,30px);height:var(--e-form-steps-indicator-padding,30px);font-size:var(--e-form-steps-indicator-icon-size);border-width:1px;border-style:solid;display:flex;justify-content:center;align-items:center;overflow:hidden;margin-bottom:10px}.e-form__indicators__indicator__icon img,.e-form__indicators__indicator__icon object,.e-form__indicators__indicator__icon svg{width:var(--e-form-steps-indicator-icon-size);height:auto}.e-form__indicators__indicator__icon .e-font-icon-svg{height:1em}.e-form__indicators__indicator__number{width:var(--e-form-steps-indicator-padding,30px);height:var(--e-form-steps-indicator-padding,30px);border-width:1px;border-style:solid;display:flex;justify-content:center;align-items:center;margin-bottom:10px}.e-form__indicators__indicator--shape-circle{border-radius:50%}.e-form__indicators__indicator--shape-square{border-radius:0}.e-form__indicators__indicator--shape-rounded{border-radius:5px}.e-form__indicators__indicator--shape-none{border:0}.e-form__indicators__indicator__label{text-align:center}.e-form__indicators__indicator__separator{width:100%;height:var(--e-form-steps-divider-width);background-color:#c2cbd2}.e-form__indicators--type-icon,.e-form__indicators--type-icon_text,.e-form__indicators--type-number,.e-form__indicators--type-number_text{align-items:flex-start}.e-form__indicators--type-icon .e-form__indicators__indicator__separator,.e-form__indicators--type-icon_text .e-form__indicators__indicator__separator,.e-form__indicators--type-number .e-form__indicators__indicator__separator,.e-form__indicators--type-number_text .e-form__indicators__indicator__separator{margin-top:calc(var(--e-form-steps-indicator-padding, 30px) \/ 2 - var(--e-form-steps-divider-width, 1px) \/ 2)}.elementor-field-type-hidden{display:none}.elementor-field-type-html{display:inline-block}.elementor-login .elementor-lost-password,.elementor-login .elementor-remember-me{font-size:.85em}.elementor-field-type-recaptcha_v3 .elementor-field-label{display:none}.elementor-field-type-recaptcha_v3 .grecaptcha-badge{z-index:1}.elementor-button .elementor-form-spinner{order:3}.elementor-form .elementor-button>span{display:flex;justify-content:center;align-items:center}.elementor-form .elementor-button .elementor-button-text{white-space:normal;flex-grow:0}.elementor-form .elementor-button svg{height:auto}.elementor-form .elementor-button .e-font-icon-svg{height:1em}.elementor-select-wrapper .select-caret-down-wrapper{position:absolute;top:50%;transform:translateY(-50%);inset-inline-end:10px;pointer-events:none;font-size:11px}.elementor-select-wrapper .select-caret-down-wrapper svg{display:unset;width:1em;aspect-ratio:unset;fill:currentColor}.elementor-select-wrapper .select-caret-down-wrapper i{font-size:19px;line-height:2}.elementor-select-wrapper.remove-before:before{content:\"\"!important}<\/style>\t\t<form class=\"elementor-form\" method=\"post\" name=\"InfraSOS Email Capture\">\n\t\t\t<input type=\"hidden\" name=\"post_id\" value=\"53712\"\/>\n\t\t\t<input type=\"hidden\" name=\"form_id\" value=\"6a698fc5\"\/>\n\t\t\t<input type=\"hidden\" name=\"referer_title\" value=\"Active Directory Tools, Report, Monitor &amp; Manage AD\" \/>\n\n\t\t\t\n\t\t\t<div class=\"elementor-form-fields-wrapper elementor-labels-above\">\n\t\t\t\t\t\t\t\t<div class=\"elementor-field-type-email elementor-field-group elementor-column elementor-field-group-email elementor-col-50 elementor-field-required\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t<input size=\"1\" type=\"email\" name=\"form_fields[email]\" id=\"form-field-email\" class=\"elementor-field elementor-size-lg  elementor-field-textual\" placeholder=\"Enter your email address\" required=\"required\" aria-required=\"true\">\n\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t\t\t\t<div class=\"elementor-field-group elementor-column elementor-field-type-submit elementor-col-50 e-form__buttons\">\n\t\t\t\t\t<button type=\"submit\" class=\"elementor-button elementor-size-lg\">\n\t\t\t\t\t\t<span >\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\" elementor-button-icon\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-button-text\">Try InfraSOS FREE<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t<\/button>\n\t\t\t\t<\/div>\n\t\t\t<\/div>\n\t\t<\/form>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t<div class=\"elementor-element elementor-element-33b59d1 e-con-boxed e-con\" data-id=\"33b59d1\" data-element_type=\"container\" data-settings=\"{&quot;content_width&quot;:&quot;boxed&quot;}\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-b192103 elementor-widget elementor-widget-text-editor\" data-id=\"b192103\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p><span style=\"color: #ff6600;\"><strong>Also Read\u00a0<a href=\"https:\/\/infrasos.com\/active-directory-reporting\/user-reports\/\">Try InfraSOS Active Directory User Reports Tool<\/a><\/strong><\/span><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-6e56a28 elementor-widget elementor-widget-heading\" data-id=\"6e56a28\" data-element_type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">Threat Detection and Prevention with Event 4624<\/h2>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-26b8789 e-con-boxed e-con\" data-id=\"26b8789\" data-element_type=\"container\" data-settings=\"{&quot;content_width&quot;:&quot;boxed&quot;}\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-4ee80ff elementor-widget elementor-widget-text-editor\" data-id=\"4ee80ff\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p><a href=\"https:\/\/infrasos.com\/top-10-best-threat-hunting-tools-in-cyber-security\/\">Threat detection and prevention<\/a> are critical in safeguarding computer systems and networks from malicious activities. Event ID 4624, a fundamental Windows Security Event Logs component, is instrumental in this endeavor. It signifies a successful logon event, offering insights into user activities and helping security professionals identify and respond to potential threats in real time. By analysing Event ID 4624 and its associated data, organizations\u00a0 proactively strengthen their cybersecurity posture, promptly detect and mitigate <a href=\"https:\/\/infrasos.com\/how-to-secure-active-directory-against-insider-threats\/\">unauthorized access attempts<\/a>, and ensure their digital assets&#8217; integrity and confidentiality.<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-eb1d0b6 e-con-boxed e-con\" data-id=\"eb1d0b6\" data-element_type=\"container\" data-settings=\"{&quot;content_width&quot;:&quot;boxed&quot;}\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-54b4475 elementor-widget elementor-widget-heading\" data-id=\"54b4475\" data-element_type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h3 class=\"elementor-heading-title elementor-size-default\">Windows Logon Types<\/h3>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-d4fddd6 e-con-boxed e-con\" data-id=\"d4fddd6\" data-element_type=\"container\" data-settings=\"{&quot;content_width&quot;:&quot;boxed&quot;}\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-aeb7077 elementor-widget elementor-widget-text-editor\" data-id=\"aeb7077\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p><span data-preserver-spaces=\"true\">Windows supports several logon types, each serving a specific purpose and authentication method. Here is a list of standard Windows logon types along with their descriptions:<\/span><\/p><ol><li><strong><span data-preserver-spaces=\"true\">Interactive Logon (Type 2):<\/span><\/strong><span data-preserver-spaces=\"true\">\u00a0Used when a user logs in directly at the computer or via a remote desktop. This logon type requires a username and password.<\/span><\/li><li><strong><span data-preserver-spaces=\"true\">Network Logon (Type 3):<\/span><\/strong><span data-preserver-spaces=\"true\">\u00a0Occurs when accessing network resources on another computer. The system sends the credentials to the remote server for authentication.<\/span><\/li><li><strong><span data-preserver-spaces=\"true\">Batch Logon (Type 4):<\/span><\/strong><span data-preserver-spaces=\"true\">\u00a0For scheduled tasks or batch jobs running under a specified user account; not interactive.<\/span><\/li><li><strong><span data-preserver-spaces=\"true\">Service Logon (Type 5):<\/span><\/strong><span data-preserver-spaces=\"true\">\u00a0Used by Windows services, starting automatically or manually with the Service Control Manager.<\/span><\/li><li><strong><span data-preserver-spaces=\"true\">Unlock Logon (Type 7):<\/span><\/strong><span data-preserver-spaces=\"true\">\u00a0Generated when unlocking a previously locked workstation; no new credentials required.<\/span><\/li><li><strong><span data-preserver-spaces=\"true\">Network Clear Text Logon (Type 8):<\/span><\/strong><span data-preserver-spaces=\"true\">\u00a0Rare and insecure; sends credentials in clear text over the network.<\/span><\/li><li><strong><span data-preserver-spaces=\"true\">New Credentials Logon (Type 9):<\/span><\/strong><span data-preserver-spaces=\"true\">\u00a0Occurs when providing different credentials for accessing network resources.<\/span><\/li><li><strong><span data-preserver-spaces=\"true\">Remote Interactive Logon (Type 10):<\/span><\/strong><span data-preserver-spaces=\"true\">\u00a0Used for remote desktop connections.<\/span><\/li><li><strong><span data-preserver-spaces=\"true\">Cached Interactive Logon (Type 11):<\/span><\/strong><span data-preserver-spaces=\"true\">\u00a0Using cached credentials when not connected to the network allows local authentication.<\/span><\/li><li><strong><span data-preserver-spaces=\"true\">Cached Remote Interactive Logon (Type 12):<\/span><\/strong><span data-preserver-spaces=\"true\">\u00a0Similar to cached interactive logon but for remote connections.<\/span><\/li><li><strong><span data-preserver-spaces=\"true\">Cached Unlock Logon (Type 13):<\/span><\/strong><span data-preserver-spaces=\"true\">\u00a0Generated when unlocking a computer with cached credentials offline.<\/span><\/li><li><strong><span data-preserver-spaces=\"true\">Cached Credential Logon (Type 14):<\/span><\/strong><span data-preserver-spaces=\"true\">\u00a0This logon type uses applications or services accessing network resources with cached credentials.<\/span><\/li><li><strong><span data-preserver-spaces=\"true\">Cached Remote Credential Logon (Type 15):<\/span><\/strong><span data-preserver-spaces=\"true\">\u00a0Similar to cached credential logon, but for remote access.<\/span><\/li><li><strong><span data-preserver-spaces=\"true\">Unlock (Type 21):<\/span><\/strong><span data-preserver-spaces=\"true\">\u00a0Occurs when unlocking a previously locked workstation.<\/span><\/li><\/ol>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-d72d652 elementor-widget elementor-widget-image\" data-id=\"d72d652\" data-element_type=\"widget\" data-widget_type=\"image.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<a href=\"https:\/\/infrasos.com\/wp-content\/uploads\/2023\/09\/event-login-types.png\" data-elementor-open-lightbox=\"yes\" data-elementor-lightbox-title=\"event login types\" data-e-action-hash=\"#elementor-action%3Aaction%3Dlightbox%26settings%3DeyJpZCI6NTM3NTEsInVybCI6Imh0dHBzOlwvXC9pbmZyYXNvcy5jb21cL3dwLWNvbnRlbnRcL3VwbG9hZHNcLzIwMjNcLzA5XC9ldmVudC1sb2dpbi10eXBlcy5wbmcifQ%3D%3D\">\n\t\t\t\t\t\t\t<img loading=\"lazy\" decoding=\"async\" width=\"768\" height=\"526\" src=\"https:\/\/infrasos.com\/wp-content\/uploads\/2023\/09\/event-login-types-768x526.png\" class=\"attachment-medium_large size-medium_large wp-image-53751\" alt=\"event login types\" srcset=\"https:\/\/infrasos.com\/wp-content\/uploads\/2023\/09\/event-login-types-768x526.png 768w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/09\/event-login-types-300x206.png 300w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/09\/event-login-types-1024x702.png 1024w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/09\/event-login-types-1536x1053.png 1536w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/09\/event-login-types-720x493.png 720w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/09\/event-login-types.png 1668w\" sizes=\"(max-width: 768px) 100vw, 768px\" \/>\t\t\t\t\t\t\t\t<\/a>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-4bb9cd1 e-con-boxed e-con\" data-id=\"4bb9cd1\" data-element_type=\"container\" data-settings=\"{&quot;content_width&quot;:&quot;boxed&quot;}\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-95f08b6 elementor-widget elementor-widget-text-editor\" data-id=\"95f08b6\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>These logon types are essential for auditing and security analysis to<a href=\"https:\/\/infrasos.com\/active-directory-reporting\/\"> monitor user activity and potential security breaches<\/a>.<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-c2e1ab3 e-con-boxed e-con\" data-id=\"c2e1ab3\" data-element_type=\"container\" data-settings=\"{&quot;content_width&quot;:&quot;boxed&quot;}\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-2b62120 elementor-widget elementor-widget-heading\" data-id=\"2b62120\" data-element_type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h3 class=\"elementor-heading-title elementor-size-default\">Suspicious Successful Logons<\/h3>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-c5788f4 e-con-boxed e-con\" data-id=\"c5788f4\" data-element_type=\"container\" data-settings=\"{&quot;content_width&quot;:&quot;boxed&quot;}\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-a10444e elementor-widget elementor-widget-text-editor\" data-id=\"a10444e\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p><span data-preserver-spaces=\"true\">Now that we have discussed the different types of Windows Logon methods, we\u00a0 start analysing which Event IDs 4624 are logged in by a malicious perpetrator. Here are some of the below examples:<\/span><\/p><ul><li><span data-preserver-spaces=\"true\">Event ID 4624 with Logon type 10 ( RemoteInteractive logins ) and the source network address is loopback ( 127.*.*.* or ::1 ), mostly RDP tunneling.<\/span><\/li><li><span data-preserver-spaces=\"true\">Event ID 4624 logon type 10 ( RemoteInteractive Logins ) and source network is not in our organization&#8217;s Subnet.<\/span><\/li><li><span data-preserver-spaces=\"true\">Event ID 4624, <a href=\"https:\/\/infrasos.com\/what-is-event-id-4625-an-account-failed-to-log-on\/\">logon type<\/a> (3 and 10), source workstation names, and destination are end-user machines.<\/span><\/li><li><span data-preserver-spaces=\"true\">Event ID 4624, with logon types (2 and 10) and an account name ending with $, like <strong>ItSupport$<\/strong>, is a possible fake machine account.<\/span><\/li><li><span data-preserver-spaces=\"true\">Event ID 4624 with more than one successful logon with logon types 3 and 10 from the same account name and different source network address is considered suspicious.<\/span><\/li><li><span data-preserver-spaces=\"true\">Event ID 4624 and logon types ( 2, 10, and 7 ) and account names like internal service accounts (<strong>svc_*<\/strong>), Possible interactive logon from a service account.<\/span><\/li><\/ul>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-e6fa413 e-con-boxed e-con\" data-id=\"e6fa413\" data-element_type=\"container\" data-settings=\"{&quot;content_width&quot;:&quot;boxed&quot;}\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-e4be87b elementor-widget elementor-widget-text-editor\" data-id=\"e4be87b\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>In the relentless pursuit of cybersecurity, the vigilance required to monitor and respond to suspicious successful logon events, often indicative of unauthorized or malicious access, remains a crucial and ongoing endeavour.<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-0b6b1e1 e-con-boxed e-con\" data-id=\"0b6b1e1\" data-element_type=\"container\" data-settings=\"{&quot;content_width&quot;:&quot;boxed&quot;}\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-e790122 elementor-widget elementor-widget-text-editor\" data-id=\"e790122\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p><span style=\"color: #ff6600;\"><strong>Also Read\u00a0<a href=\"https:\/\/infrasos.com\/active-directory-reporting\/\">Try InfraSOS Active Directory Reporting &amp; Auditing Tool<\/a><\/strong><\/span><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-000cb3d elementor-widget elementor-widget-heading\" data-id=\"000cb3d\" data-element_type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">Get-Event log for Event ID 4624 using PowerShell<\/h2>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-d5ead8d e-con-boxed e-con\" data-id=\"d5ead8d\" data-element_type=\"container\" data-settings=\"{&quot;content_width&quot;:&quot;boxed&quot;}\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-1f04475 elementor-widget elementor-widget-text-editor\" data-id=\"1f04475\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>Like any other graphical user interface (GUI) in the Windows operating system, we access information through command-line interface (CLI) commands, such as those available in <a href=\"https:\/\/infrasos.com\/top-5-active-directory-powershell-scripts-for-active-directory-users-groups\/\">Windows PowerShell<\/a>. To obtain event logs related to event ID 4624, PowerShell provides us with convenient cmdlets like <a href=\"https:\/\/learn.microsoft.com\/en-us\/powershell\/module\/microsoft.powershell.management\/get-eventlog?view=powershell-5.1\" target=\"_blank\" rel=\"noopener\"><strong>Get-EventLog<\/strong><\/a> and <a href=\"https:\/\/learn.microsoft.com\/en-us\/powershell\/module\/microsoft.powershell.diagnostics\/get-winevent?view=powershell-7.3\" target=\"_blank\" rel=\"noopener\"><strong>Get-WinEvent<\/strong><\/a>. Let&#8217;s demonstrate how to retrieve event logs for event ID 4624 using the <strong>Get-EventLog<\/strong> command in PowerShell.<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-746e4fc e-con-boxed e-con\" data-id=\"746e4fc\" data-element_type=\"container\" data-settings=\"{&quot;content_width&quot;:&quot;boxed&quot;}\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-b839d88 elementor-widget elementor-widget-code-highlight\" data-id=\"b839d88\" data-element_type=\"widget\" data-widget_type=\"code-highlight.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"prismjs-default copy-to-clipboard \">\n\t\t\t<pre data-line=\"\" class=\"highlight-height language-javascript line-numbers\">\n\t\t\t\t<code readonly=\"true\" class=\"language-javascript\">\n\t\t\t\t\t<xmp>$currentDate = [DateTime]::Now.AddDays(-1) \nGet-EventLog -LogName \"Security\" -After $currentDate | Where -FilterScript {$_.EventID -eq 4624} <\/xmp>\n\t\t\t\t<\/code>\n\t\t\t<\/pre>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-e44d9a0 e-con-boxed e-con\" data-id=\"e44d9a0\" data-element_type=\"container\" data-settings=\"{&quot;content_width&quot;:&quot;boxed&quot;}\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-e018258 elementor-widget elementor-widget-text-editor\" data-id=\"e018258\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p><span data-preserver-spaces=\"true\">In the above syntax:<\/span><\/p><ul><li><strong><span data-preserver-spaces=\"true\">Get-EventLog<\/span><\/strong><span data-preserver-spaces=\"true\">\u00a0gets event ID 4624 events for the specified date using the $currentDate variable.<\/span><\/li><li><span data-preserver-spaces=\"true\">It uses the\u00a0<\/span><strong><span data-preserver-spaces=\"true\">LogName<\/span><\/strong><span data-preserver-spaces=\"true\">\u00a0parameter to determine the log name of the event, like\u00a0<\/span><a href=\"https:\/\/infrasos.com\/active-directory-security-best-practices-protecting-your-environment\/\"><strong><span data-preserver-spaces=\"true\">Security<\/span><\/strong><\/a><\/li><li><span data-preserver-spaces=\"true\">All Event IDs are filtered out equal to 4624 using the <strong>FilterScript<\/strong> parameter.<\/span><\/li><\/ul>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-fb27058 e-con-boxed e-con\" data-id=\"fb27058\" data-element_type=\"container\" data-settings=\"{&quot;content_width&quot;:&quot;boxed&quot;}\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-f1becfa elementor-widget elementor-widget-text-editor\" data-id=\"f1becfa\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p><span data-preserver-spaces=\"true\">We also get event logs for event ID 4624 using the <\/span><strong><span data-preserver-spaces=\"true\">Get-WinEvent<\/span><\/strong><span data-preserver-spaces=\"true\">\u00a0command in PowerShell:<\/span><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-76a490f e-con-boxed e-con\" data-id=\"76a490f\" data-element_type=\"container\" data-settings=\"{&quot;content_width&quot;:&quot;boxed&quot;}\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-671053d elementor-widget elementor-widget-code-highlight\" data-id=\"671053d\" data-element_type=\"widget\" data-widget_type=\"code-highlight.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"prismjs-default copy-to-clipboard \">\n\t\t\t<pre data-line=\"\" class=\"highlight-height language-javascript line-numbers\">\n\t\t\t\t<code readonly=\"true\" class=\"language-javascript\">\n\t\t\t\t\t<xmp>Get-WinEvent -FilterHashtable @{LogName = 'Security'; ID = 4624} <\/xmp>\n\t\t\t\t<\/code>\n\t\t\t<\/pre>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-ebcc87a e-con-boxed e-con\" data-id=\"ebcc87a\" data-element_type=\"container\" data-settings=\"{&quot;content_width&quot;:&quot;boxed&quot;}\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-a57e1da elementor-widget elementor-widget-text-editor\" data-id=\"a57e1da\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p><span data-preserver-spaces=\"true\">In the above Windows PowerShell script,<\/span><\/p><ul><li><strong><span data-preserver-spaces=\"true\">Get-WinEvent<\/span><\/strong><span data-preserver-spaces=\"true\">\u00a0gets the event log for event ID 4624.<\/span><\/li><li><span data-preserver-spaces=\"true\">It uses the\u00a0<\/span><strong><span data-preserver-spaces=\"true\">FilterHashtable<\/span><\/strong><span data-preserver-spaces=\"true\">\u00a0parameter and LogName as Security to bring these events<\/span><\/li><\/ul>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-1aa98a8 e-con-boxed e-con\" data-id=\"1aa98a8\" data-element_type=\"container\" data-settings=\"{&quot;content_width&quot;:&quot;boxed&quot;}\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-9ff9c0f elementor-widget elementor-widget-text-editor\" data-id=\"9ff9c0f\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>Utilizing PowerShell&#8217;s event cmdlet to retrieve Event ID 4624 entries provides a powerful means of monitoring and responding to successful logon events, enabling proactive detection and mitigation of potential security threats in the ever-evolving cybersecurity landscape.<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-71435e9 elementor-widget elementor-widget-text-editor\" data-id=\"71435e9\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>Thank you for reading What is Windows Event ID 4624 ? \u2013 Successful Logon. We shall conclude this article.<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-0178b4e e-con-boxed e-con\" data-id=\"0178b4e\" data-element_type=\"container\" data-settings=\"{&quot;content_width&quot;:&quot;boxed&quot;}\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-186b862 elementor-widget elementor-widget-text-editor\" data-id=\"186b862\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p><span style=\"color: #ff6600;\"><strong>Also Read\u00a0<a href=\"https:\/\/infrasos.com\/windows-server-security-best-practices-secure-your-windows-server-environment\/\">Windows Server Security Best Practices: Secure Your Windows Server Environment<\/a><\/strong><\/span><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-65c2e4f elementor-widget elementor-widget-text-editor\" data-id=\"65c2e4f\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>Thank you for reading What is Windows Event ID 4624 ? \u2013 Successful Logon. We conclude this article.<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-8e8f00c elementor-widget elementor-widget-heading\" data-id=\"8e8f00c\" data-element_type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h2 class=\"elementor-heading-title elementor-size-large\">What is Windows Event ID 4624 ? \u2013 Successful Logon Conclusion<\/h2>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-89114dd e-con-boxed e-con\" data-id=\"89114dd\" data-element_type=\"container\" data-settings=\"{&quot;content_width&quot;:&quot;boxed&quot;}\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-f83cbb3 elementor-widget elementor-widget-text-editor\" data-id=\"f83cbb3\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>In conclusion, Windows Event ID 4624 is a fundamental system security and monitoring pillar. It is an indispensable tool for tracking and comprehending<a href=\"https:\/\/infrasos.com\/windows-server-hardening-configure-security-settings-policies-for-windows-server\/\"> user access to Windows-based environments<\/a>, offering valuable insights into login events by providing information about who gains access, when it occurs, and from where Event ID 4624 empowers cybersecurity professionals to bolster their systems&#8217; security posture and swiftly respond to potential threats. It is an essential component in the arsenal of security measures, ensuring the integrity and confidentiality of digital assets while enabling proactive threat detection and prevention.<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-23aa6146 elementor-section-content-middle ot-traditional elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"23aa6146\" data-element_type=\"section\" data-settings=\"{&quot;background_background&quot;:&quot;classic&quot;}\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-extended\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-50 elementor-top-column elementor-element elementor-element-64eb737f ot-flex-column-vertical\" data-id=\"64eb737f\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t\t\t<div class=\"elementor-element elementor-element-449906d0 elementor-widget elementor-widget-image\" data-id=\"449906d0\" data-element_type=\"widget\" data-widget_type=\"image.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<img loading=\"lazy\" decoding=\"async\" width=\"113\" height=\"101\" src=\"https:\/\/infrasos.com\/wp-content\/uploads\/2022\/05\/InfraSOS-Logo-Icon-1.png\" class=\"attachment-full size-full wp-image-5788\" alt=\"InfraSOS-AD-Tools\" \/>\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t<div class=\"elementor-column elementor-col-50 elementor-top-column elementor-element elementor-element-167b6324 ot-flex-column-vertical\" data-id=\"167b6324\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t\t\t<div class=\"elementor-element elementor-element-6a9a235c elementor-widget elementor-widget-heading\" data-id=\"6a9a235c\" data-element_type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">Try InfraSOS for FREE<\/h2>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-4596c8a4 elementor-widget elementor-widget-text-editor\" data-id=\"4596c8a4\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>Try InfraSOS Active Directory, Azure AD &amp; Office 365 Reporting &amp; Auditing Tool<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-3f802ac7 elementor-button-align-center elementor-invisible elementor-widget elementor-widget-global elementor-global-5815 elementor-widget-form\" data-id=\"3f802ac7\" data-element_type=\"widget\" data-settings=\"{&quot;button_width&quot;:&quot;50&quot;,&quot;step_next_label&quot;:&quot;Next&quot;,&quot;step_previous_label&quot;:&quot;Previous&quot;,&quot;_animation&quot;:&quot;pulse&quot;,&quot;step_type&quot;:&quot;none&quot;,&quot;step_icon_shape&quot;:&quot;circle&quot;}\" data-widget_type=\"form.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<form class=\"elementor-form\" method=\"post\" name=\"InfraSOS Email Capture\">\n\t\t\t<input type=\"hidden\" name=\"post_id\" value=\"53712\"\/>\n\t\t\t<input type=\"hidden\" name=\"form_id\" value=\"3f802ac7\"\/>\n\t\t\t<input type=\"hidden\" name=\"referer_title\" value=\"Active Directory Tools, Report, Monitor &amp; Manage AD\" \/>\n\n\t\t\t\n\t\t\t<div class=\"elementor-form-fields-wrapper elementor-labels-above\">\n\t\t\t\t\t\t\t\t<div class=\"elementor-field-type-email elementor-field-group elementor-column elementor-field-group-email elementor-col-50 elementor-field-required\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t<input size=\"1\" type=\"email\" name=\"form_fields[email]\" id=\"form-field-email\" class=\"elementor-field elementor-size-lg  elementor-field-textual\" placeholder=\"Enter your email address\" required=\"required\" aria-required=\"true\">\n\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t\t\t\t<div class=\"elementor-field-group elementor-column elementor-field-type-submit elementor-col-50 e-form__buttons\">\n\t\t\t\t\t<button type=\"submit\" class=\"elementor-button elementor-size-lg\">\n\t\t\t\t\t\t<span >\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\" elementor-button-icon\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-button-text\">Try InfraSOS FREE<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t<\/button>\n\t\t\t\t<\/div>\n\t\t\t<\/div>\n\t\t<\/form>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-4a1af9d3 elementor-icon-list--layout-inline elementor-list-item-link-full_width elementor-widget elementor-widget-icon-list\" data-id=\"4a1af9d3\" data-element_type=\"widget\" data-widget_type=\"icon-list.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<link rel=\"stylesheet\" href=\"https:\/\/infrasos.com\/wp-content\/plugins\/elementor\/assets\/css\/widget-icon-list.min.css\">\t\t<ul class=\"elementor-icon-list-items elementor-inline-items\">\n\t\t\t\t\t\t\t<li class=\"elementor-icon-list-item elementor-inline-item\">\n\t\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-icon-list-icon\">\n\t\t\t\t\t\t\t<i aria-hidden=\"true\" class=\"fas fa-arrow-up\"><\/i>\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-icon-list-text\">Free 15-Days Trial<\/span>\n\t\t\t\t\t\t\t\t\t<\/li>\n\t\t\t\t\t\t\t\t<li class=\"elementor-icon-list-item elementor-inline-item\">\n\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-icon-list-text\">SaaS AD Reporting & Auditing Solution<\/span>\n\t\t\t\t\t\t\t\t\t<\/li>\n\t\t\t\t\t\t<\/ul>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t\t\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"<p>What is Windows Event ID 4624 ? \u2013 Successful Logon. Windows Event ID 4624, often called Successful Logon event, is a pivotal component of Windows Security Event Logs that is an integral tool for monitoring and securing computer systems. This event code is system generated. Whenever a user successfully logs into a Windows based system, [&hellip;]<\/p>\n","protected":false},"author":7,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[33,38],"tags":[47,45],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v20.5 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>What is Windows Event ID 4624 ? \u2013 Successful Logon<\/title>\n<meta name=\"description\" content=\"What is Windows Event ID 4624 ? \u2013 Successful Logon. Windows Event ID 4624, often called Successful Logon event, is a pivotal component of Windows Security\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/infrasos.com\/what-is-windows-event-id-4624-successful-logon-2\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"What is Windows Event ID 4624 ? \u2013 Successful Logon\" \/>\n<meta property=\"og:description\" content=\"What is Windows Event ID 4624 ? \u2013 Successful Logon. Windows Event ID 4624, often called Successful Logon event, is a pivotal component of Windows Security\" \/>\n<meta property=\"og:url\" content=\"https:\/\/infrasos.com\/what-is-windows-event-id-4624-successful-logon-2\/\" \/>\n<meta property=\"og:site_name\" content=\"Active Directory Tools, Report, Monitor &amp; Manage AD\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/infrasos\/\" \/>\n<meta property=\"article:published_time\" content=\"2023-09-16T09:30:00+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2023-09-15T14:16:42+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/infrasos.com\/wp-content\/uploads\/elementor\/thumbs\/Untitled-2-1-qc5aff6h1jh7oxgjbtqfdmh02uojeqrtt08b9pa200.png\" \/>\n<meta name=\"author\" content=\"Marion Mendoza\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@infra_sos\" \/>\n<meta name=\"twitter:site\" content=\"@infra_sos\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Marion Mendoza\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"8 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/infrasos.com\/what-is-windows-event-id-4624-successful-logon-2\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/infrasos.com\/what-is-windows-event-id-4624-successful-logon-2\/\"},\"author\":{\"name\":\"Marion Mendoza\",\"@id\":\"https:\/\/infrasos.com\/#\/schema\/person\/ad83c2c1c7a69db768dcf68c16a09dc1\"},\"headline\":\"What is Windows Event ID 4624 ? \u2013 Successful Logon\",\"datePublished\":\"2023-09-16T09:30:00+00:00\",\"dateModified\":\"2023-09-15T14:16:42+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/infrasos.com\/what-is-windows-event-id-4624-successful-logon-2\/\"},\"wordCount\":1346,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\/\/infrasos.com\/#organization\"},\"keywords\":[\"active directory\",\"cybersecurity\"],\"articleSection\":[\"Active Directory\",\"Cybersecurity\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/infrasos.com\/what-is-windows-event-id-4624-successful-logon-2\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/infrasos.com\/what-is-windows-event-id-4624-successful-logon-2\/\",\"url\":\"https:\/\/infrasos.com\/what-is-windows-event-id-4624-successful-logon-2\/\",\"name\":\"What is Windows Event ID 4624 ? \u2013 Successful Logon\",\"isPartOf\":{\"@id\":\"https:\/\/infrasos.com\/#website\"},\"datePublished\":\"2023-09-16T09:30:00+00:00\",\"dateModified\":\"2023-09-15T14:16:42+00:00\",\"description\":\"What is Windows Event ID 4624 ? \u2013 Successful Logon. Windows Event ID 4624, often called Successful Logon event, is a pivotal component of Windows Security\",\"breadcrumb\":{\"@id\":\"https:\/\/infrasos.com\/what-is-windows-event-id-4624-successful-logon-2\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/infrasos.com\/what-is-windows-event-id-4624-successful-logon-2\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/infrasos.com\/what-is-windows-event-id-4624-successful-logon-2\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/infrasos.com\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"What is Windows Event ID 4624 ? \u2013 Successful Logon\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/infrasos.com\/#website\",\"url\":\"https:\/\/infrasos.com\/\",\"name\":\"Active Directory Tools, Report, Monitor &amp; Manage AD\",\"description\":\"Active Directory &amp; Office 365 SaaS Reporting Tool\",\"publisher\":{\"@id\":\"https:\/\/infrasos.com\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/infrasos.com\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/infrasos.com\/#organization\",\"name\":\"InfraSOS - Active Directory & Office 365 Reporting Tools\",\"url\":\"https:\/\/infrasos.com\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/infrasos.com\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/infrasos.com\/wp-content\/uploads\/2022\/10\/InfraSOS-Logo-Icon.png\",\"contentUrl\":\"https:\/\/infrasos.com\/wp-content\/uploads\/2022\/10\/InfraSOS-Logo-Icon.png\",\"width\":113,\"height\":101,\"caption\":\"InfraSOS - Active Directory & Office 365 Reporting Tools\"},\"image\":{\"@id\":\"https:\/\/infrasos.com\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/www.facebook.com\/infrasos\/\",\"https:\/\/twitter.com\/infra_sos\",\"https:\/\/www.linkedin.com\/showcase\/86283876\",\"https:\/\/www.youtube.com\/channel\/UCfGszuZdgxZYBg8DGIWxXCg\"]},{\"@type\":\"Person\",\"@id\":\"https:\/\/infrasos.com\/#\/schema\/person\/ad83c2c1c7a69db768dcf68c16a09dc1\",\"name\":\"Marion Mendoza\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/infrasos.com\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/30fe5e9718f2d84e943c56822bf2c846?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/30fe5e9718f2d84e943c56822bf2c846?s=96&d=mm&r=g\",\"caption\":\"Marion Mendoza\"},\"description\":\"Windows Server and VMware SME. Powershell Guru. Currently working with Fortune 500 companies responsible for participating in 3rd level systems support across the enterprise. Acting as a Windows Server engineer and VMware Specialist.\",\"url\":\"https:\/\/infrasos.com\/author\/marionpkm\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"What is Windows Event ID 4624 ? \u2013 Successful Logon","description":"What is Windows Event ID 4624 ? \u2013 Successful Logon. Windows Event ID 4624, often called Successful Logon event, is a pivotal component of Windows Security","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/infrasos.com\/what-is-windows-event-id-4624-successful-logon-2\/","og_locale":"en_US","og_type":"article","og_title":"What is Windows Event ID 4624 ? \u2013 Successful Logon","og_description":"What is Windows Event ID 4624 ? \u2013 Successful Logon. Windows Event ID 4624, often called Successful Logon event, is a pivotal component of Windows Security","og_url":"https:\/\/infrasos.com\/what-is-windows-event-id-4624-successful-logon-2\/","og_site_name":"Active Directory Tools, Report, Monitor &amp; Manage AD","article_publisher":"https:\/\/www.facebook.com\/infrasos\/","article_published_time":"2023-09-16T09:30:00+00:00","article_modified_time":"2023-09-15T14:16:42+00:00","og_image":[{"url":"https:\/\/infrasos.com\/wp-content\/uploads\/elementor\/thumbs\/Untitled-2-1-qc5aff6h1jh7oxgjbtqfdmh02uojeqrtt08b9pa200.png"}],"author":"Marion Mendoza","twitter_card":"summary_large_image","twitter_creator":"@infra_sos","twitter_site":"@infra_sos","twitter_misc":{"Written by":"Marion Mendoza","Est. reading time":"8 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/infrasos.com\/what-is-windows-event-id-4624-successful-logon-2\/#article","isPartOf":{"@id":"https:\/\/infrasos.com\/what-is-windows-event-id-4624-successful-logon-2\/"},"author":{"name":"Marion Mendoza","@id":"https:\/\/infrasos.com\/#\/schema\/person\/ad83c2c1c7a69db768dcf68c16a09dc1"},"headline":"What is Windows Event ID 4624 ? \u2013 Successful Logon","datePublished":"2023-09-16T09:30:00+00:00","dateModified":"2023-09-15T14:16:42+00:00","mainEntityOfPage":{"@id":"https:\/\/infrasos.com\/what-is-windows-event-id-4624-successful-logon-2\/"},"wordCount":1346,"commentCount":0,"publisher":{"@id":"https:\/\/infrasos.com\/#organization"},"keywords":["active directory","cybersecurity"],"articleSection":["Active Directory","Cybersecurity"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/infrasos.com\/what-is-windows-event-id-4624-successful-logon-2\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/infrasos.com\/what-is-windows-event-id-4624-successful-logon-2\/","url":"https:\/\/infrasos.com\/what-is-windows-event-id-4624-successful-logon-2\/","name":"What is Windows Event ID 4624 ? \u2013 Successful Logon","isPartOf":{"@id":"https:\/\/infrasos.com\/#website"},"datePublished":"2023-09-16T09:30:00+00:00","dateModified":"2023-09-15T14:16:42+00:00","description":"What is Windows Event ID 4624 ? \u2013 Successful Logon. Windows Event ID 4624, often called Successful Logon event, is a pivotal component of Windows Security","breadcrumb":{"@id":"https:\/\/infrasos.com\/what-is-windows-event-id-4624-successful-logon-2\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/infrasos.com\/what-is-windows-event-id-4624-successful-logon-2\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/infrasos.com\/what-is-windows-event-id-4624-successful-logon-2\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/infrasos.com\/"},{"@type":"ListItem","position":2,"name":"What is Windows Event ID 4624 ? \u2013 Successful Logon"}]},{"@type":"WebSite","@id":"https:\/\/infrasos.com\/#website","url":"https:\/\/infrasos.com\/","name":"Active Directory Tools, Report, Monitor &amp; Manage AD","description":"Active Directory &amp; Office 365 SaaS Reporting Tool","publisher":{"@id":"https:\/\/infrasos.com\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/infrasos.com\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/infrasos.com\/#organization","name":"InfraSOS - Active Directory & Office 365 Reporting Tools","url":"https:\/\/infrasos.com\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/infrasos.com\/#\/schema\/logo\/image\/","url":"https:\/\/infrasos.com\/wp-content\/uploads\/2022\/10\/InfraSOS-Logo-Icon.png","contentUrl":"https:\/\/infrasos.com\/wp-content\/uploads\/2022\/10\/InfraSOS-Logo-Icon.png","width":113,"height":101,"caption":"InfraSOS - Active Directory & Office 365 Reporting Tools"},"image":{"@id":"https:\/\/infrasos.com\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/infrasos\/","https:\/\/twitter.com\/infra_sos","https:\/\/www.linkedin.com\/showcase\/86283876","https:\/\/www.youtube.com\/channel\/UCfGszuZdgxZYBg8DGIWxXCg"]},{"@type":"Person","@id":"https:\/\/infrasos.com\/#\/schema\/person\/ad83c2c1c7a69db768dcf68c16a09dc1","name":"Marion Mendoza","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/infrasos.com\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/30fe5e9718f2d84e943c56822bf2c846?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/30fe5e9718f2d84e943c56822bf2c846?s=96&d=mm&r=g","caption":"Marion Mendoza"},"description":"Windows Server and VMware SME. Powershell Guru. Currently working with Fortune 500 companies responsible for participating in 3rd level systems support across the enterprise. Acting as a Windows Server engineer and VMware Specialist.","url":"https:\/\/infrasos.com\/author\/marionpkm\/"}]}},"_links":{"self":[{"href":"https:\/\/infrasos.com\/wp-json\/wp\/v2\/posts\/53712"}],"collection":[{"href":"https:\/\/infrasos.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/infrasos.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/infrasos.com\/wp-json\/wp\/v2\/users\/7"}],"replies":[{"embeddable":true,"href":"https:\/\/infrasos.com\/wp-json\/wp\/v2\/comments?post=53712"}],"version-history":[{"count":23,"href":"https:\/\/infrasos.com\/wp-json\/wp\/v2\/posts\/53712\/revisions"}],"predecessor-version":[{"id":54121,"href":"https:\/\/infrasos.com\/wp-json\/wp\/v2\/posts\/53712\/revisions\/54121"}],"wp:attachment":[{"href":"https:\/\/infrasos.com\/wp-json\/wp\/v2\/media?parent=53712"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/infrasos.com\/wp-json\/wp\/v2\/categories?post=53712"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/infrasos.com\/wp-json\/wp\/v2\/tags?post=53712"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}