Windows distinguishes between Account Logon events (authentication of credentials) and Logon events (gaining access to resources). Understanding where each type is logged is fundamental to effective investigation and threat hunting.
The Core Distinction
Microsoft uses specific terminology that investigators must understand clearly. Account Logon refers to the authentication process—verifying that credentials are valid. Logon describes the act of an account actually accessing a resource. Both categories generate entries in the Security event log, but they appear on different systems depending on the architecture.
Domain accounts are authenticated by domain controllers in a Windows network environment. Local accounts stored in the SAM database are authenticated by the host where they reside. The key principle: authentication events are logged by the system performing the authentication, not necessarily by the system the user ultimately accesses.
This architecture means your domain controllers provide a relatively centralized view of authentication activity across the domain. However, you must query all domain controllers to build a complete picture, since each DC logs only the authentications it personally handles.
When you discover authentication events on member servers or workstations, this typically signals that local accounts are being used. Because most enterprise environments discourage local account usage, account logon events on non-DC systems can serve as an early indicator of compromise.
In contrast, logon events are generated by the system being accessed. This means logon records scatter across your entire network, reinforcing the importance of centralized log aggregation.
Audit Policy and Log Protection
Group Policy makes it straightforward to enable auditing for both Account Logon and Logon events. Although Microsoft has progressively enabled more logging by default in recent Windows releases, administrators should regularly review audit policies to confirm that all systems generate sufficient logs.
Storing event logs on remote systems—whether through native Microsoft forwarding or third-party SIEM solutions—helps protect logs from tampering or deletion by attackers. This is especially critical for domain controllers, which hold centralized authentication records.
Kerberos Authentication Events on Domain Controllers
Domain controllers that authenticate domain users generate several critical Event IDs related to Kerberos ticket operations.
Event ID 4768: TGT Issuance
Event ID 4768 records the issuance of a Ticket Granting Ticket (TGT), indicating that a user account was successfully authenticated by the domain controller. The Network Information section contains details about the remote host when authentication occurs remotely. The Keywords field shows whether the attempt succeeded or failed.
When authentication fails, the result code provides diagnostic information per RFC 4120. Common result codes include:
| Decimal | Hex | Meaning |
|---|---|---|
| 6 | 0x6 | Username not valid |
| 12 | 0xC | Policy restriction (workstation or time-of-day) |
| 18 | 0x12 | Account locked, disabled, or expired |
| 23 | 0x17 | Password expired |
| 24 | 0x18 | Incorrect password |
| 32 | 0x20 | Ticket expired (common for computer accounts) |
| 37 | 0x25 | Clock skew too great |
Event ID 4769: Service Ticket Requests
This event captures service ticket requests made by user accounts for specific resources. The event description includes the source IP of the requesting system, the user account involved, and the target service. These records are invaluable for tracking authenticated user activity across the network.
The Keywords field indicates success or failure. On failure, the result code explains why. The ticket encryption type is also recorded, which can help detect attacks targeting Kerberos weaknesses.
Event ID 4770: Service Ticket Renewal
Event ID 4770 logs service ticket renewals, recording the account name, service name, client IP address, and encryption type.
Event ID 4771: Kerberos Pre-Authentication Failure
Depending on the nature of a Kerberos logon failure, either Event ID 4768 or 4771 is generated. In both cases, the result code provides details about why authentication failed.
NTLM Authentication Events
Event ID 4776: NTLM Authentication Attempts
Event ID 4776 captures NTLM authentication attempts. Like Kerberos events, the Network Information section contains remote host details for remote logon attempts. The Keywords field indicates success or failure, and error codes provide additional context on failures.
A sequence of failed 4776 events with error code 0xC000006A (invalid password) followed by 0xC0000234 (account locked) may indicate a password guessing attack—or simply a user who has forgotten their password. Similarly, multiple failed 4776 events followed by a successful one could represent a successful password guessing attack.
The presence of Event ID 4776 on a member server or workstation indicates an attempt to authenticate to a local account on that system, which may warrant investigation in environments where local accounts should not be used.
Common error codes for Event ID 4776 include:
| Error Code | Meaning |
|---|---|
| 0xC0000064 | Incorrect username |
| 0xC000006A | Incorrect password |
| 0xC000006D | Generic logon failure (bad username/password or LAN Manager Authentication Level mismatch) |
| 0xC000006F | Logon outside authorized hours |
| 0xC0000070 | Logon from unauthorized workstation |
| 0xC0000071 | Logon with expired password |
| 0xC0000072 | Account disabled by administrator |
| 0xC0000193 | Expired account |
| 0xC0000224 | Change Password At Next Logon flagged |
| 0xC0000234 | Account locked |
| 0xc0000371 | Local account store lacks secret material for account |
Logon Events on Accessed Systems
Systems being accessed generate their own set of logon-related Event IDs.
Event ID 4624: Successful Logon
Event ID 4624 records successful logons to a system. The logon type code distinguishes different access methods:
- Type 2: Interactive logon (typically local keyboard/screen access, or remote access tools like VNC or PsExec with
-uswitch). Credentials are cached in RAM and possibly on disk. - Type 3: Network logon (accessing a shared folder remotely). Non-interactive; credentials are not cached.
- Type 4: Batch (scheduled task execution).
- Type 5: Service started by Service Control Manager.
- Type 7: Workstation unlock.
- Type 8: NetworkCleartext (password passed in unhashed form, often IIS with basic authentication).
- Type 9: NewCredentials (logon with alternate credentials via RunAs or mapped drive).
- Type 10: RemoteInteractive (Terminal Services, Remote Desktop, or Remote Assistance). Successful RDP connections typically log as Type 10, which may cache credentials in RAM and on disk (Restricted Admin mode may affect this).
- Type 11: CachedInteractive (logon with cached domain credentials when domain controller is unavailable).
The event description contains information about the host and account. For remote logons, focus on the Network Information section. Correlating with associated 4768, 4769, or 4776 events can yield additional remote host details.
Discrepancies between the recorded hostname and its assigned IP address may indicate SMB relay attacks, where an attacker relays requests using an IP not associated with the legitimate system.
The Caller Process Name and Caller Process ID fields in the Process Information section provide details about the process initiating the logon.
Failed RDP logons usually result in Logon Type 3 rather than Type 10. Successful RDP connections log as Type 10, representing a remote interactive logon.
Event ID 4625: Failed Logon
Event ID 4625 captures failed logon attempts. Large volumes of these events across a network may signal password guessing or password spraying campaigns. The Network Information section provides valuable details about remote hosts attempting access.
Failed RDP logons may log as Type 3 rather than Type 10, depending on system configuration. The Failure Information section contains status codes that explain the failure reason:
| Status Code | Description |
|---|---|
| 0xC000005E | No logon servers available |
| 0xC0000064 | Misspelled or bad username |
| 0xC000006A | Misspelled or bad password |
| 0xC000006D | Bad username or incorrect authentication information |
| 0xC000006E | Unknown username or bad password |
| 0xC000006F | Logon outside authorized hours |
| 0xC0000070 | Logon from unauthorized workstation |
| 0xC0000071 | Expired password |
| 0xC0000072 | Account disabled by administrator |
| 0xC00000DC | Server in wrong state |
| 0xC0000133 | Clock skew too great |
| 0xC000015B | User not granted requested logon right |
| 0xC000018C | Trust relationship failure |
| 0xC0000192 | Netlogon service not started |
| 0xC0000193 | Expired account |
| 0xC0000224 | User must change password at next logon |
| 0xC0000225 | Apparent Windows bug, not a risk |
| 0xC0000234 | Account locked |
| 0xC00002EE | Error occurred during logon |
| 0xC0000413 | Authentication firewall blocking logon |
Event ID 4634 / 4647: Logoff
User logoff is recorded by Event ID 4634 or 4647. However, Windows is inconsistent in logging these events, so the absence of a logoff event should not be considered highly suspicious. The Logon ID field links the 4624 logon event with its corresponding logoff event (Logon IDs are unique between reboots on the same computer).
Type 3 (Network) logons typically disconnect shortly after completing a request and do not reflect the actual duration of user activity. Interactive logons (primarily Type 2, but also Types 10 and 11) provide a better sense of session duration, though Windows may disconnect sessions due to inactivity long after a user stops interacting.
Event ID 4648: Explicit Credential Use
Event ID 4648 is logged when a user attempts to use credentials other than those of the current logon session. This includes bypassing User Account Control (UAC) to open a process with administrator permissions.
Event ID 4672: Special Privileges Assigned
This event records when certain privileges associated with elevated or administrator access are granted to a logon. Like all logon events, it is generated by the system being accessed.
RDP Session Events
Event ID 4778: Session Reconnection
Event ID 4778 logs when a session is reconnected to a Windows station. This can occur locally via fast user switching or when an RDP session reconnects. The initial RDP connection is logged with Event ID 4624 as mentioned earlier.
To distinguish between RDP and local session switching, examine the Session Name field. If local, it will contain Console; if remote, it will begin with RDP. For RDP sessions, remote host information appears in the Network Information section.
Event ID 4779: Session Disconnection
Event ID 4779 logs session disconnections, which can occur locally via fast user switching or when an RDP session disconnects. A full RDP logoff is logged with Event ID 4634 or 4647.
As with 4778, examine the Session Name field to differentiate between local (Console) and remote (RDP- prefix) disconnections. For RDP sessions, remote host information is in the Network Information section.
Additional RDP Logging Sources
Beyond the Security log, two operational logs provide valuable RDP session details:
TerminalServices-LocalSessionManager Operational Log
(%SystemRoot%\System32\winevt\Logs\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational)
- Event ID 21: Session logon events (local and remote), including source IP for remote connections.
- Event ID 24: Session disconnection, including source IP for remote connections. For local logons, the Source Network Address field reads
LOCALinstead of an IP.
TerminalServices-RemoteConnectionManager Operational Log
(%SystemRoot%\System32\winevt\Logs\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational)
- Event ID 1149: Shows the user account and source IP used to initiate an RDP session.
Summary
Understanding the distinction between authentication and access events is essential for effective Windows log analysis. Authentication events centralize on domain controllers (or local systems for local accounts), while access events scatter across the network. By monitoring key Event IDs—4768, 4769, 4770, and 4771 for Kerberos; 4776 for NTLM; 4624 and 4625 for logons; and 4778/4779 for RDP sessions—investigators can track user activity, detect anomalies, and identify potential compromises. Proper audit configuration and centralized log collection are critical to maintaining visibility across the environment.