Logon Events

Understanding Authentication vs. Access: Windows Account Logon and Logon Events

A deep dive into the critical distinction between Account Logon (authentication) and Logon (resource access) events in Windows Security logs, covering essential Event IDs for Kerberos, NTLM, RDP sessions, and detecting potential compromises.