← cd ~/events
// events/4624 · Sign-in
Event ID 4624An account was successfully logged on
A logon session was created on the computer that was accessed. The Logon Type field tells you how (2 interactive, 3 network, 4 batch, 5 service, 7 unlock, 8 network cleartext, 9 new credentials, 10 Remote Desktop, 11 cached interactive).
| Log | Security |
|---|---|
| Source | Microsoft-Windows-Security-Auditing |
| Area | Sign-in |
What to check
Filter on high-value accounts and on Elevated Token = Yes for admin logons. Treat batch (4) or service (5) logons by domain admins, and type 10 logons without Restricted Admin where it is mandated, as worth investigating.
Codes you'll see in this event
| Code | Meaning |
|---|---|
2 | Interactive: signed in at the console. |
3 | Network: for example a file share or remote management. |
4 | Batch: scheduled task or batch server. |
5 | Service: started by the Service Control Manager. |
7 | Unlock: workstation unlocked. |
8 | NetworkCleartext: password passed to the authentication package unhashed. |
9 | NewCredentials: cloned token with new credentials for outbound connections (for example RunAs /netonly). |
10 | RemoteInteractive: Remote Desktop or Terminal Services. |
11 | CachedInteractive: cached credentials, no DC contacted. |
Find it with PowerShell
Run on the machine that logs it, as an administrator.
Get-WinEvent -FilterHashtable @{ LogName = 'Security'; Id = 4624 } -MaxEvents 50 |
Format-List TimeCreated, Id, MessageHunt for it in Sentinel or Log Analytics
Security events land in the SecurityEvent table when you collect them with the Windows Security Events connector or a data collection rule.
SecurityEvent
| where TimeGenerated > ago(7d)
| where EventID == 4624
| project TimeGenerated, Computer, Account, Activity
| order by TimeGenerated descRelated Sign-in events
- Event ID 4625: An account failed to log on
- Event ID 4634: An account was logged off
- Event ID 4647: User initiated logoff
- Event ID 4648: A logon was attempted using explicit credentials
- Event ID 4672: Special privileges assigned to new logon
- Event ID 4776: The computer attempted to validate the credentials for an account