Windows 10: Windows Audit Log

I work as a Security Analyst, I have been going through the windows logs of a client organization. Where there's a lot of login success event at off times. I would like to know, how to differentiate between a login attempt is an actual login or just some services getting login privileges windows?

:)

 

Audit Success logs

I can disable windows log services but when i disable it my networking stops working, i can not see any wireless network nor connect any. I also tried deleting all the logs but my windows creates these useless audit success logs again.

Hope i there is a solution to stop these audit logs at all.

By the way i am using windows 10 home if it helps.

 

Q about audit logs

When setting up audit logging under Computer Configuration -> Windows Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Logon/Logoff -> Audit Account Lockout, if I enable the Success option, how does this log get triggered? When
an account is locked out, a failure event is fired under the Account Locked category. But when an account is unlocked, an event is fired under the User Account Management category. How would a successful account lockout event get fired? What would that even
be?

 

Audit mode

Hi Diane,

Windows boots into Windows Welcome Mode and Audit Mode. Windows Welcome Mode
is the first user experience while the Audit mode is used to add customization to Windows images. Sometimes, Windows keeps running in Audit Mode and user has no idea about it, just like in your case. While your machine is running Audit
Mode when upgrading or reinstalling Windows 10, the upgrade won’t progress.

Here's how to exit from Audit mode to reinstall Windows 10:

• Open the administrative or elevated Command Prompt. Type cmd in the
  Search field at the taskbar.
• Type the following command and press Enter key: sysprep /oobe /generalize
  DISCLAIMER: Running sysprep command each time resets Windows licensing state to default. So if your Windows is activated and you run this command, you’ll need to reactivate Windows after executing this command.
  
  
• Once the command IS successfully executed, you’ll be out of Audit Mode. Now you can re-try to upgrade to Windows 10 and it should work.

Let us know if the steps above worked for you.