4624 : An account was successfully logged on

  • Generates when a logon session is created (on destination machine). It generates on the computer that was accessed, where the session was created.
4624An account was successfully logged on
CategoryAudit Logon/Logoff
Event TypeSuccess
ProviderMicrosoft-Windows-Security-Auditing
ChannelSecurity
CriticityLow
VolumetryHIGH
Referencehttps://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4624

Monitoring Recommendations :

  • Always consider monitoring 4624 event, because it’s very talkative and reports useful information.
  • Because this event is typically triggered by the SYSTEM account, it’s recommend to report it only whenever “Subject\Security ID” isn’t SYSTEM
  • Use filters when polling domain controller for this event because it’s one of the most noisiest event.

Security Monitoring Recommendations :

  • Monitor “Restricted Admin” mode. monitor logons by “New Logon\Security ID” in relation to “Logon Type“=10 and “Restricted Admin Mode“=”Yes”. If “Restricted Admin Mode“=”No” for these accounts, trigger an alert.
  • Monitor all logon events for accounts with administrator privileges, monitor this event with “Elevated Token“=”Yes”.
  • Monitor all logon events for MSa and GMSa service accounts, monitor for events with “Virtual Account“=”Yes”.
  • Monitor for a mismatch between the logon type and the account that uses it (for example, if Logon Type 4-Batch or 5-Service is used by a member of a domain administrative group), monitor Logon Type in this event.
  • If you monitor for potentially malicious software, or software that isn’t authorized to request logon actions, monitor this event for Process Name.
  • If you have a trusted logon processes list, monitor for a Logon Process that isn’t from the list.
  • Monitor Logon Restrictions :
    • If the user account “New Logon\Security ID” should never be used to log on from the specific Computer:.
    • If New Logon\Security ID credentials shouldn’t be used from Workstation Name or Source Network Address.
    • If a specific account, such as a service account, should only be used from your internal IP address list (or some other list of IP addresses). In this case, you can monitor for Network Information\Source Network Address and compare the network address with your list of IP addresses.
  • Monitor NTLM Usage :
    • If a particular version of NTLM is always used in your organization. In this case, you can use this event to monitor Package Name (NTLM only), for example, to find events where Package Name (NTLM only) doesn’t equal NTLM V2.
    • If NTLM isn’t used in your organization, or shouldn’t be used by a specific account (New Logon\Security ID). In this case, monitor for all events where Authentication Package is NTLM.
    • If the Authentication Package is NTLM. In this case, monitor for Key Length not equal to 128, because all Windows operating systems starting with Windows 2000 support 128-bit Key Length.

Exemples of 4624 events

Get 4624 event details with PowerShell :

  • Event 4624 Structure (Version 2)
Displayed ValueXML ValueDescription
[Subject]
Security ID		SubjectUserSidSID of account or Name (if SID can’t be resolved) that reported information about successful logon or invokes it.
[Subject]
Account Name		SubjectUserNameName of the account that reported information about successful logon
[Subject]
Account Domain		SubjectDomainNameSubject’s domain or computer name.
For some well-known security principals, such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is “NT AUTHORITY“.
[Subject]
Logon ID		SubjectLogonIdHexadecimal value that can be correlated with recent events that might contain the same Logon ID, for example, “4672: Special privileges assigned to new logon.“
[Logon Information]
Logon Type		Logon TypeThe type of logon that happened. The next table contains the list of possible values for this field
[Logon Information]
Restricted Admin Mode		Restricted Admin ModeOnly populated for RemoteInteractive logon type sessions1. This value is a Yes/No flag indicating if the credentials provided were passed using Restricted Admin mode.
If not a RemoteInteractive logon, then this value is the string: –
[Logon Information]
Virtual Account		Virtual AccountA “Yes” or “No” flag, which indicates if the account is a virtual account (for example, “Managed Service Account“), which was introduced in Windows 7 and Windows Server 2008 R2 to identify the account that a given Service uses, instead of just using “NetworkService“.
[Logon Information]
Elevated Token		Elevated TokenA “Yes” or “No” flag. If “Yes”, then the session this event represents is elevated and has administrator privileges.
– %%1842 value stands for YES
– %%1843 value stands for NO
[Impersonation Level]
Impersonation Level		Impersonation LevelCan have one of these four values:
– SecurityAnonymous2 (displayed as empty string)
– SecurityIdentification3 (displayed as “Identification“)
– SecurityImpersonation4 (displayed as “Impersonation“)
– SecurityDelegation5 (displayed as “Delegation“)
[New Logon]
Security ID		Security IDSID of the account or Name (if SID can’t be resolved) for which logon was performed.
[New Logon]
Account Name		Account NameName of the account for which logon was performed.
[New Logon]
Account Domain		Account DomainSubject’s domain or computer name.
For some well-known security principals, such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is “NT AUTHORITY“.
[New Logon]
Logon ID		Logon IDHexadecimal value that can be correlated with recent events that might contain the same Logon ID, for example, “4672: Special privileges assigned to new logon.“
[New Logon]
Linked Logon ID		Linked Logon IDHexadecimal value of the paired logon session. If there’s no other logon session associated with this logon session, then the value is “0x0“.
[New Logon]
Network Account Name		Network Account NameUser name that’s used for outbound (network) connections. Valid only for NewCredentials logon type.
If not NewCredentials logon, then this value will be the string: –
[New Logon]
Network Account Domain		Network Account DomainDomain for the user that’s used for outbound (network) connections. Valid only for NewCredentials logon type.
If not NewCredentials logon, then this value will be the string: –
[New Logon]
Logon GUID		Logon GUIDGUID that can be correlated with another event that can contain the same Logon GUID, “4769: A Kerberos service ticket was requested event on a domain controller” and “4648: A logon was attempted using explicit credentials” and “4964: Special groups have been assigned to a new logon“.
[Process Information]
Process ID		Process IDHexadecimal Process ID of the process that attempted the logon.
Once converted the hexadecimal value to decimal, it can be compares to the values in Task Manager.
This process ID with a process ID in other events, for example, “4688: A new process has been created” Process Information\New Process ID.
[Process Information]
Process Name		Process NameFull path and the name of the executable for the process
[Network Information]6
Workstation Name		Workstation NameMachine name from which a logon attempt was performed.
Network logons with Kerberos have no workstation information.
[Network Information]
Source Network Address		Source Network AddressIP address of machine from which logon attempt was performed.
NTLM logons have no TCP/IP details.
[Network Information]
Source Port		Source PortThe source port that was used for logon attempt from remote machine.
0 for interactive logons.
NTLM logons have no TCP/IP details.
[Detailed Authentication Information]
Logon Process		Logon ProcessName of the trusted logon process that was used for the logon. See event “4611: A trusted logon process has been registered with the Local Security Authority” description for more information.
[Detailed Authentication Information]
Authentication Package		Authentication PackageName of the authentication package that was used for the logon authentication process.
Default packages loaded on LSA startup are located in “HKLM\SYSTEM\CurrentControlSet\Control\Lsa\OSConfig” registry key. Other packages can be loaded at runtime.
When a new package is loaded a “4610: An authentication package has been loaded by the Local Security Authority” (typically for NTLM) or “4622: A security package has been loaded by the Local Security Authority” (typically for Kerberos) event is logged to indicate that a new package has been loaded along with the package name.
The most common authentication packages are: NTLM, Kerberos, Negociate8
[Detailed Authentication Information]
Transited Services		Transited ServicesList of transmitted services.
Transmitted services are populated if the logon was a result of a S4U9 (Service For User) logon process.
[Detailed Authentication Information]
Package Name (NTLM only)		Package Name (NTLM only)Name of the LAN Manager subpackage that was used during logon.
Possible values are: “LM”, “NTLM V1”, “NTLM V2”.
Only populated if “Authentication Package” = “NTLM”.
[Detailed Authentication Information]
Key Length		Key LengthLength of NTLM Session Security key. Typically it has 128-bit or 56-bit length.
This parameter is always 0 if “Authentication Package” = “Kerberos” (not applicable for Kerberos protocol), and also has a 0 value if Kerberos was negotiated using Negotiate authentication package.
Event 4624 Structure v2
  • Netlogon Types
Logon TypeLogon Type NameDescription
0SystemUsed only by the System account, for example at system startup.
2InteractiveA user logged on to this computer.
3NetworkA user or computer logged on to this computer from the network.
4BatchBatch logon type is used by batch servers, where processes can be run on behalf of a user without their direct intervention.
5ServiceThe Service Control Manager started a service.
7UnlockThis workstation was unlocked.
8NetworkCleartextA user logged on to this computer from the network. The user’s password was passed to the authentication package in its unhashed form. The built-in authentication packages all hash credentials before sending them across the network. The credentials don’t traverse the network in plaintext (also called cleartext).
9NewCredentialsA caller cloned its current token and specified new credentials for outbound connections. The new logon session has the same local identity, but uses different credentials for other network connections.
10RemoteInteractiveA user logged on to this computer remotely using Terminal Services or Remote Desktop.
11CachedInteractiveA user logged on to this computer with network credentials that were stored locally on the computer. The domain controller wasn’t contacted to verify the credentials.
12CachedRemoteInteractiveSame as RemoteInteractive. This type is used for internal auditing.
13CachedUnlockWorkstation logon.
Netlogon Types
  • Security Provider List
CodeNameDescription
NegotiateC:\Windows\system32\lsasrv.dllNegotiate between Kerberos and NTLM.
NegoExtenderC:\Windows\system32\negoexts.DLLExtension to negotiate with additional SSPs.
KerberosC:\Windows\system32\kerberos.DLLKerberos v5 implementation.
NTLMC:\Windows\system32\msv1_0.DLLNTLM implementation
TSSSPC:\Windows\system32\tspkg.DLLImplements CredSSP (SSO for TerminalServices & RDP).
pku2uC:\Windows\system32\pku2u.DLLImplements P2P authentication (e.g. homegroups).
CloudAPC:\Windows\system32\cloudAP.DLLImplements Azure cloud authentication.
WDigestC:\Windows\system32\wdigest.DLLImplements digest authentication (HTTP, LDAP, …).
SchannelC:\Windows\system32\schannel.DLLImplements TLS (including SSL & PCT which are considered obsolete).
Microsoft Unified Security Protocol ProviderC:\Windows\system32\schannel.DLL
Windows Credentials Providers
  • Get XML template of the 4624 event
(Get-WinEvent -ListProvider Microsoft-Windows-Security-Auditing).Events | ? {$_.Id -eq '4624'}
  • Script to export in a CSV filtered 4624 events
    • Filter events by : Last 24H, NTLMv1,for specific user
# Audit 4624 Events (An account was successfully logged on)
# EventID_4624_AccountLoggedOnSuccessfully.ps1
# wiki.l0ran.xyz
# September 5th, 2024

# Filter out all 4624 Events (Use it carefully because 4624 is a very noisy event)
$Xpath_4624_all = '*[System[EventID=4624]]'

# Filter out all last 24H events 4624
$Xpath_4624_all_Last24h = "Event[System[(EventID=4624) and TimeCreated[timediff(@SystemTime) <= 86400000]]]"

# Filter NTLM V1
$Xpath_4624_NTLMv1 = "Event[System[(EventID=4624)]]and Event[EventData[Data[@Name='LmPackageName']='NTLM V1']]" 

# Filter on specific user
$xpath_4624_SpecificUsr = "Event[System[(EventID=4624)]]and Event[EventData[Data[@TargetUserName='username']]]"

# CSV Output folder
$CSVOutputFolder = 'C:\tmp'

# CSV Outfile
$CSVOutFile = "$CSVOutputFolder\EventID_4624_AccountLoggedOnSuccessfully.csv"

$dom = @()
$DCList = @()
$dom = (Get-ADDomainController).domain
$DCList = (Get-ADDomainController -filter * -server $dom).hostname

function get-4624
{param
  ([Object]
    [Parameter(Mandatory=$true, ValueFromPipeline=$true, HelpMessage="Data to process")]
    $InputObject
  )
  process
  {$eventXml_4624 = ([xml]$InputObject.ToXml()).Event
        
        [PSCustomObject]@{
                Date = [DateTime]$eventXml_4624.System.TimeCreated.SystemTime
                RecordID = $eventXml_4624.System.EventRecordID
                Computer = $eventXml_4624.System.Computer
                Provider = $eventXml_4624.System.Provider.Name
                Level = $eventXml_4624.System.Level
                EventID = $eventXml_4624.System.EventID
                EventVersion = $eventXml_4624.System.Version
                Keywords = $eventXml_4624.System.Keywords
                SubjectUserSid = $eventXml_4624.EventData.data[0].'#text'
                SubjectUserName = $eventXml_4624.EventData.data[1].'#text'
                SubjectDomainName = $eventXml_4624.EventData.data[2].'#text'
                SubjectLogonId = $eventXml_4624.EventData.data[3].'#text'
                TargetUserSid = $eventXml_4624.EventData.data[4].'#text'
                TargetUserName = $eventXml_4624.EventData.data[5].'#text'
                TargetDomainName = $eventXml_4624.EventData.data[6].'#text'
                TargetLogonId = $eventXml_4624.EventData.data[7].'#text'
                LogonType = $eventXml_4624.EventData.data[8].'#text'
                LogonProcessName = $eventXml_4624.EventData.data[9].'#text'
                AuthenticationPackageName = $eventXml_4624.EventData.data[10].'#text'
                WorkstationName = $eventXml_4624.EventData.data[11].'#text'
                LogonGuid = $eventXml_4624.EventData.data[12].'#text'
                TransmittedServices = $eventXml_4624.EventData.data[13].'#text'
                LmPackageName = $eventXml_4624.EventData.data[14].'#text'
                KeyLength = $eventXml_4624.EventData.data[15].'#text'
                ProcessId = $eventXml_4624.EventData.data[16].'#text'
                ProcessName = $eventXml_4624.EventData.data[17].'#text'
                IpAddress = $eventXml_4624.EventData.data[18].'#text'
                IpPort = $eventXml_4624.EventData.data[19].'#text'
                ImpersonationLevel = $eventXml_4624.EventData.data[20].'#text'
                RestrictedAdminMode = $eventXml_4624.EventData.data[21].'#text'
                TargetOutboundUserName = $eventXml_4624.EventData.data[22].'#text'
                TargetOutboundDomainName = $eventXml_4624.EventData.data[23].'#text'
                VirtualAccount = $eventXml_4624.EventData.data[24].'#text'
                TargetLinkedLogonId = $eventXml_4624.EventData.data[25].'#text'
                ElevatedToken = $eventXml_4624.EventData.data[26].'#text'}}
}

foreach ($DC in $DCList)
{write-host "Working on $DC" -ForegroundColor Cyan
  Get-WinEvent -Logname security -ComputerName $DC -FilterXPath $Xpath_4624_NTLMv1 -ea 0 | 
  get-4624 |
 Export-Csv -Delimiter ';' -path $CSVOutFile -NoTypeInformation -Append}

# Remove duplicates records (if so)
$FilteredCSV = import-csv -Path $CSVOutFile -Delimiter ";" 
$FilteredCSV = ((($FilteredCSV) | Sort-Object -Property RecordID -Unique) | Sort-Object -Descending -Property Date) |  
Export-Csv -Delimiter ";" -path $CSVOutFile -NoTypeInformation

  1. Restricted Admin Mode [Version 2] [Type = UnicodeString]: Only populated for RemoteInteractive logon type sessions. This value is a Yes/No flag indicating if the credentials provided were passed using Restricted Admin mode. Restricted Admin mode was added in Windows 8.1 and Windows Server 2012 R2, but this flag was added to the event in Windows 10.
    Reference: https://blogs.technet.com/b/kfalde/archive/2013/08/14/restricted-admin-mode-for-rdp-in-windows-8-1-2012-r2.aspx.     ↩︎
  2. SecurityAnonymous (displayed as empty string): The server process can’t obtain identification information about the client, and it can’t impersonate the client. It’s defined with no value given, and thus, by ANSI C rules, defaults to a value of zero. ↩︎
  3. SecurityIdentification (displayed as “Identification“): The server process can obtain information about the client, such as security identifiers and privileges, but it can’t impersonate the client. This value is useful for servers that export their own objects, for example, database products that export tables and views. Using the retrieved client-security information, the server can make access-validation decisions without being able to use other services that are using the client’s security context. ↩︎
  4. SecurityImpersonation (displayed as “Impersonation“): The server process can impersonate the client’s security context on its local system. The server can’t impersonate the client on remote systems. This type is the most common. ↩︎
  5. SecurityDelegation (displayed as “Delegation“): The server process can impersonate the client’s security context on remote systems. ↩︎
  6. The fields for IP address/port and workstation name are populated depending on the authentication context and protocol used. LSASS will audit the information the authenticating service shares with LSASS. For example, network logons with Kerberos likely have no workstation information, and NTLM logons have no TCP/IP details. ↩︎
  7. The Negotiate security package selects between Kerberos and NTLM protocols. Negotiate selects Kerberos unless it can’t be used by one of the systems involved in the authentication or the calling application didn’t provide sufficient information to use Kerberos. ↩︎
  8. S4U is a Microsoft extension to the Kerberos Protocol to allow an application service to obtain a Kerberos service ticket on behalf of a user – most commonly done by a front-end website to access an internal resource on behalf of a user. For more information about S4U, see https://msdn.microsoft.com/library/cc246072.aspx ↩︎