Windows 10: Multiple Event ID 4624 in Event Viewer

Hi guys. Lets say I went out and left my laptop at home. When I come back I notice many "Audit Success" logs with ID 4624 in the Event Viewer during the time I was out. Is this something I should be concerned about and that someone has been trying to access my laptop? Thanks!

submitted by /u/NoUreNotTheOnlyOne
[link] [comments]

:)

 

Multiple events for event Id 4624.

We wanted to collect unique logon sucessful events. When i check event logger we found there are multiple entires for event id 4624 for single login attempt.

how we can differentiate between user generated events and event genrated by windows process?

 

Logon Event IDs Explanations

Hi,

I'm a non-dev person and would like some answers regarding Event Viewer in Windows 10. I wanted to keep tabs on if my PC was logged in during my absence. I found that Event ID 4624 shows the successful logins. But when I filter the ID, it turns out that

several events are being logged and there's no way to find out which time actually a human logged in. My questions are:

1. My Event viewer for 4624 filter looks like this: https://sc.vtedev.com/hafiz/02_10_2020_0000.png . Is this normal?

2. If yes, how can I separate the actual human logins from these automated logs?

3. If no, is there a malware that's causing it?

4. Am I using wrong Event ID? If yes, can you suggest me the correct one?

I'd really appreciate any help on this. Thanks and great day!

 

Event 4624 log deleted

Hi, BO,

I am an Independent Advisor and will assist you.

Event ID 4624

Identifies the account that requested the logon - NOT the user who just logged on. Subject is usually Null or one of the Service principals and not usually useful information.

https://docs.microsoft.com/en-us/windows/securi...

Pat