Windows 10: Understanding about Audit Logon Event

Discus and support Understanding about Audit Logon Event in Windows 10 Software and Apps to solve the problem; We recently have logs showing duplicate login/logout events of the user's account within seconds as well as Kerberos Ticket request. We can confirm... Discussion in 'Windows 10 Software and Apps' started by BryanEM, Jul 31, 2023.

  1. BryanEM Win User

    Understanding about Audit Logon Event


    We recently have logs showing duplicate login/logout events of the user's account within seconds as well as Kerberos Ticket request. We can confirm that there is no physical user that is logging into the client machine. However, the logs are showing the logon events of the user's account. Is there any policy or services that are generating all these logs? Appreciate if someone can explain to me. Thanks.

    :)
     
    BryanEM, Jul 31, 2023
    #1

  2. Security Audit Failure Event 5061 In Windows 10

    Hello,

    A failure audit event is triggered when a defined action, such as a user logon, is not completed successfully.

    The appearance of failure audit events in the event log does not necessarily mean that something is wrong with your system. For example, if you configure Audit Logon events, a failure event may simply mean that a user mistyped his or her password.

    Advanced Security Auditing FAQ
     
    Smittychat., Jul 31, 2023
    #2
  3. Amit_Sun Win User
    Events 4672 & 4624 Win 10 Freezes - special LOGON ?

    Hi,

    Thank you for writing to Microsoft Community Forums.

    1. Are you on a domain network?
    2. May I know the make and the model number of your system?

    The event logs you have provided seems to be the security logs that is generated when you login to your system. For more information on the event that was generated, you can check
    4672(S): Special privileges assigned to new logon.

    The Windows error logs will be located at Event Viewer > Windows Logs > System.

    Please follow the step below and check if it works for you.

    Step: Improve Windows 10 Performance.

    Try some of the following suggestions to help
    make your Windows 10 PC run better
    . The steps are listed in order, so start with the first one, see if that fixes the problem, and then continue to the next one if it doesn’t.

    Note: The last step on the article contains Windows Reset, I suggest you not to perform Windows reset, as there is a change your data and applications will be wiped and also
    the OS will reverted back to previous version you upgraded from.

    If the issue still persists, please reply to this post with more information so that we can identify the root cause of this issue and assist you further.

    Hope it helps.

    Amit Sunar

    Microsoft Community – Moderator
     
    Amit_Sun, Jul 31, 2023
    #3
  4. Understanding about Audit Logon Event

    SPECIAL LOGON in Event Log

    Could these SPECIAL LOGON events be from when I AM USING a 'Private browser window'??? Or is it really someone trying to hack in... ALSO in the Event Log it shows an 'Audit Success' immediately following... so does that mean ,y computer is still SAFE????
     
    Emeline419, Jul 31, 2023
    #4
Thema:

Understanding about Audit Logon Event

Loading...
  1. Understanding about Audit Logon Event - Similar Threads - Understanding Audit Logon

  2. ENtra ID audit last logon user

    in Windows 10 Gaming
    ENtra ID audit last logon user: Look like the delay to get the last login is over 15 minutes, and the log get the information only if the computer reboot and the user login, if the user logout and login , no activity are record on the audit log, is this normal. how do we get the last login date and time the...
  3. Understanding about Audit Logon Event

    in Windows 10 Gaming
    Understanding about Audit Logon Event: We recently have logs showing duplicate login/logout events of the user's account within seconds as well as Kerberos Ticket request. We can confirm that there is no physical user that is logging into the client machine. However, the logs are showing the logon events of the...
  4. Understanding about Audit Logon Event

    in AntiVirus, Firewalls and System Security
    Understanding about Audit Logon Event: We recently have logs showing duplicate login/logout events of the user's account within seconds as well as Kerberos Ticket request. We can confirm that there is no physical user that is logging into the client machine. However, the logs are showing the logon events of the...
  5. Security Auditing ID: 4624/4672 Special Logon and Logon

    in Windows 10 Gaming
    Security Auditing ID: 4624/4672 Special Logon and Logon: Hello, Im constantly getting this audit success every 5-10 minutes. I need help on what this is, and how can I fix it, because it freezes my computer like hardlock and goes back to normal. Here is both events Views. First is Special Logon and Second is LogonSPECIAL...
  6. Security Auditing ID: 4624/4672 Special Logon and Logon

    in Windows 10 Software and Apps
    Security Auditing ID: 4624/4672 Special Logon and Logon: Hello, Im constantly getting this audit success every 5-10 minutes. I need help on what this is, and how can I fix it, because it freezes my computer like hardlock and goes back to normal. Here is both events Views. First is Special Logon and Second is LogonSPECIAL...
  7. Understanding of Event Time

    in Windows 10 Gaming
    Understanding of Event Time: I would like to understand at which time the below event or incident was triggered.Event Description - "The operating system started at system time ‎2022‎-‎03‎-‎16T11:07:45.375200000Z."...
  8. Disable auditing of successful events

    in Windows 10 Performance & Maintenance
    Disable auditing of successful events: This command worked Code: auditpol /Set /Caregory:* /success:disable I need to check event log, if there are reported any longer successful events. Problem is overall: there are too many categories to check manually. I ran this command: Code: auditpol /Get /Category:* And it...
  9. Audit Lock/Unlock events

    in AntiVirus, Firewalls and System Security
    Audit Lock/Unlock events: I know how to enable advanced auditing for other logon-logoff events in order to catch lock/unlocking of a Windows computer. See link for reference:...
  10. Logon event

    in Windows 10 BSOD Crashes and Debugging
    Logon event: Hello, can someone help me to get out what kind of event is above? I can't understand who or what trying to connect into 192.168.10.50 server. A logon was attempted using explicit credentials. Subject: Security ID: SYSTEM Account Name: PC-1074-050917$ Account Domain: test...