Windows Event ID 4624 – Microsoft-Windows-Security-Auditing: An Account Was Successfully Logged On

Open Event Viewer and navigate to Windows Logs → Security to examine Event ID 4624 details.

1. Press Win + R, type eventvwr.msc, and press Enter
2. Expand Windows Logs and click Security
3. In the Actions pane, click Filter Current Log
4. Enter 4624 in the Event IDs field and click OK
5. Double-click any 4624 event to view detailed information

Key fields to examine:

• Subject: Account that requested the logon
• New Logon: Account that was authenticated
• Logon Type: Method of authentication (2=Interactive, 3=Network, 5=Service, etc.)
• Logon Process: Authentication package used
• Source Network Address: IP address of the source system
• Workstation Name: Name of the computer initiating the logon

Use PowerShell to query and analyze Event ID 4624 events with advanced filtering capabilities.

# Get recent successful logon events
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4624} -MaxEvents 50 | 
    Select-Object TimeCreated, Id, LevelDisplayName, Message

Filter by specific logon types:

# Filter for interactive logons only (Type 2)
$Events = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4624}
$Events | Where-Object {
    ([xml]$_.ToXml()).Event.EventData.Data | 
    Where-Object {$_.Name -eq 'LogonType' -and $_.'#text' -eq '2'}
} | Select-Object TimeCreated, Message

Extract specific event data fields:

# Parse event data into custom objects
$LogonEvents = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4624} -MaxEvents 100
$LogonEvents | ForEach-Object {
    $xml = [xml]$_.ToXml()
    $eventData = $xml.Event.EventData.Data
    [PSCustomObject]@{
        TimeCreated = $_.TimeCreated
        TargetUserName = ($eventData | Where-Object {$_.Name -eq 'TargetUserName'}).'#text'
        LogonType = ($eventData | Where-Object {$_.Name -eq 'LogonType'}).'#text'
        IpAddress = ($eventData | Where-Object {$_.Name -eq 'IpAddress'}).'#text'
        WorkstationName = ($eventData | Where-Object {$_.Name -eq 'WorkstationName'}).'#text'
    }
} | Format-Table -AutoSize

Optimize audit policy settings to capture the most relevant logon events while managing log volume.

Check current audit policy settings:

# View current logon audit settings
auditpol /get /subcategory:"Logon"

Configure audit policies through Group Policy:

1. Open Group Policy Management Console (gpmc.msc)
2. Navigate to Computer Configuration → Policies → Windows Settings → Security Settings → Advanced Audit Policy Configuration
3. Expand Audit Policies → Logon/Logoff
4. Configure Audit Logon to Success (and optionally Failure)

Set audit policies via command line:

# Enable success and failure auditing for logon events
auditpol /set /subcategory:"Logon" /success:enable /failure:enable

Configure Security log size and retention:

1. Open Event Viewer → Windows Logs → Security
2. Right-click Security and select Properties
3. Set Maximum log size to appropriate value (e.g., 1 GB)
4. Choose retention method: Archive the log when full or Overwrite events as needed

Create automated monitoring solutions to track suspicious logon patterns and generate alerts for security incidents.

Create a PowerShell script for continuous monitoring:

# Monitor for unusual logon patterns
$StartTime = (Get-Date).AddHours(-1)
$SuspiciousLogons = Get-WinEvent -FilterHashtable @{
    LogName='Security'
    Id=4624
    StartTime=$StartTime
} | ForEach-Object {
    $xml = [xml]$_.ToXml()
    $eventData = $xml.Event.EventData.Data
    $logonType = ($eventData | Where-Object {$_.Name -eq 'LogonType'}).'#text'
    $ipAddress = ($eventData | Where-Object {$_.Name -eq 'IpAddress'}).'#text'
    $userName = ($eventData | Where-Object {$_.Name -eq 'TargetUserName'}).'#text'
    
    # Flag suspicious patterns
    if ($logonType -eq '3' -and $ipAddress -notmatch '^(10\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[01])\.)') {
        [PSCustomObject]@{
            Time = $_.TimeCreated
            User = $userName
            Type = $logonType
            SourceIP = $ipAddress
            Suspicious = 'External Network Logon'
        }
    }
} | Where-Object {$_.Suspicious}

if ($SuspiciousLogons) {
    $SuspiciousLogons | Format-Table
    # Send alert email or write to monitoring system
}

Set up Windows Task Scheduler for automated execution:

1. Open Task Scheduler (taskschd.msc)
2. Click Create Basic Task in the Actions pane
3. Name the task "Logon Event Monitor" and set appropriate trigger (e.g., every 15 minutes)
4. Set action to start PowerShell with your monitoring script
5. Configure task to run with appropriate permissions

Use Windows Event Forwarding for centralized collection:

# Configure event forwarding subscription
wecutil cs subscription.xml

# Example subscription XML content:
# <Subscription xmlns="http://schemas.microsoft.com/2006/03/windows/events/subscription">
#   <SubscriptionId>LogonEvents</SubscriptionId>
#   <Query><![CDATA[<QueryList><Query Id="0"><Select Path="Security">*[System[EventID=4624]]</Select></Query></QueryList>]]></Query>
# </Subscription>

Perform comprehensive forensic analysis by correlating Event ID 4624 with related security events for incident investigation.

Correlate with logoff events (4634) to track session duration:

# Find matching logon/logoff pairs
$LogonEvents = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4624} -MaxEvents 100
$LogoffEvents = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4634} -MaxEvents 100

$SessionAnalysis = foreach ($logon in $LogonEvents) {
    $logonXml = [xml]$logon.ToXml()
    $logonData = $logonXml.Event.EventData.Data
    $logonId = ($logonData | Where-Object {$_.Name -eq 'TargetLogonId'}).'#text'
    $userName = ($logonData | Where-Object {$_.Name -eq 'TargetUserName'}).'#text'
    
    $matchingLogoff = $LogoffEvents | Where-Object {
        $logoffXml = [xml]$_.ToXml()
        $logoffData = $logoffXml.Event.EventData.Data
        $logoffId = ($logoffData | Where-Object {$_.Name -eq 'TargetLogonId'}).'#text'
        $logoffId -eq $logonId
    } | Select-Object -First 1
    
    [PSCustomObject]@{
        User = $userName
        LogonTime = $logon.TimeCreated
        LogoffTime = if ($matchingLogoff) { $matchingLogoff.TimeCreated } else { 'Still Active' }
        SessionDuration = if ($matchingLogoff) { 
            New-TimeSpan -Start $logon.TimeCreated -End $matchingLogoff.TimeCreated 
        } else { 'Ongoing' }
        LogonId = $logonId
    }
}

$SessionAnalysis | Format-Table -AutoSize

Analyze authentication patterns and detect anomalies:

# Detect unusual logon times or frequencies
$TimeWindow = (Get-Date).AddDays(-7)
$RecentLogons = Get-WinEvent -FilterHashtable @{
    LogName='Security'
    Id=4624
    StartTime=$TimeWindow
}

# Group by user and analyze patterns
$UserPatterns = $RecentLogons | ForEach-Object {
    $xml = [xml]$_.ToXml()
    $eventData = $xml.Event.EventData.Data
    [PSCustomObject]@{
        User = ($eventData | Where-Object {$_.Name -eq 'TargetUserName'}).'#text'
        Time = $_.TimeCreated
        Hour = $_.TimeCreated.Hour
        DayOfWeek = $_.TimeCreated.DayOfWeek
        LogonType = ($eventData | Where-Object {$_.Name -eq 'LogonType'}).'#text'
        SourceIP = ($eventData | Where-Object {$_.Name -eq 'IpAddress'}).'#text'
    }
} | Group-Object User

# Identify users with unusual patterns
foreach ($userGroup in $UserPatterns) {
    $user = $userGroup.Name
    $logons = $userGroup.Group
    
    # Check for off-hours activity (before 6 AM or after 10 PM)
    $offHoursLogons = $logons | Where-Object {$_.Hour -lt 6 -or $_.Hour -gt 22}
    
    if ($offHoursLogons) {
        Write-Host "ALERT: User $user has off-hours logons:" -ForegroundColor Red
        $offHoursLogons | Format-Table Time, LogonType, SourceIP
    }
}

Export comprehensive forensic report:

# Generate detailed forensic report
$ForensicReport = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4624} -MaxEvents 1000 | 
ForEach-Object {
    $xml = [xml]$_.ToXml()
    $eventData = $xml.Event.EventData.Data
    [PSCustomObject]@{
        EventTime = $_.TimeCreated
        EventID = $_.Id
        SubjectUserName = ($eventData | Where-Object {$_.Name -eq 'SubjectUserName'}).'#text'
        TargetUserName = ($eventData | Where-Object {$_.Name -eq 'TargetUserName'}).'#text'
        LogonType = ($eventData | Where-Object {$_.Name -eq 'LogonType'}).'#text'
        LogonProcessName = ($eventData | Where-Object {$_.Name -eq 'LogonProcessName'}).'#text'
        AuthenticationPackageName = ($eventData | Where-Object {$_.Name -eq 'AuthenticationPackageName'}).'#text'
        WorkstationName = ($eventData | Where-Object {$_.Name -eq 'WorkstationName'}).'#text'
        SourceNetworkAddress = ($eventData | Where-Object {$_.Name -eq 'IpAddress'}).'#text'
        SourcePort = ($eventData | Where-Object {$_.Name -eq 'IpPort'}).'#text'
    }
}

$ForensicReport | Export-Csv -Path "C:\Forensics\Logon_Analysis_$(Get-Date -Format 'yyyyMMdd_HHmmss').csv" -NoTypeInformation