Windows Event LogsAuthentication AnalysisKerberos+3
Understanding Authentication vs. Access: Windows Account Logon and Logon Events
A deep dive into the critical distinction between Account Logon (authentication) and Logon (resource access) events in Windows Security logs, covering essential Event IDs for Kerberos, NTLM, RDP sessions, and detecting potential compromises.
Sep 14, 202610 min read