{"id":12,"date":"2016-02-08T09:11:18","date_gmt":"2016-02-08T09:11:18","guid":{"rendered":"http:\/\/eventlogxp.com\/blog\/?p=12"},"modified":"2016-04-19T08:43:23","modified_gmt":"2016-04-19T08:43:23","slug":"exploring-who-logged-on-the-system","status":"publish","type":"post","link":"https:\/\/eventlogxp.com\/blog\/exploring-who-logged-on-the-system\/","title":{"rendered":"Exploring who logged on the system"},"content":{"rendered":"

One of the most important tasks in the security event log analysis is to find out who or what logs your system on. Here I will explain how Event Log Explorer helps you to solve this task.<\/p>\n

First, you need to make sure that Windows security auditing is enabled for logon events. You can do this using Local Security Policy or Group Policy, depending on your network environment.<\/p>\n

Read more about Windows Security Auditing at http:\/\/eventlogxp.com\/essentials\/securityauditing.html<\/a><\/em><\/p>\n

Open Security event log with Event Log Explorer. As a rule, you will get too many different events, but now we are interested in events with the following Event IDs:<\/p>\n\n\n\n\n
4624<\/td>\nAn account was successfully logged on<\/td>\n<\/tr>\n
4625<\/td>\nAn account failed to log on<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

There are several ways to filter events by Event ID, I prefer using Log Loading Filter:<\/p>\n

From the main menu select View->Log Loading Options and then in Event IDs filed type
\n4624, 4625<\/strong><\/em>
\nthen\u00a0press OK.
\n\"Log<\/a><\/p>\n

Now you can see only several interested events, but it is still not very clear. User column displays nothing for both successful and failure events (in fact, User column is useless for Security log since Windows 2008\/Vista).
\n\"filteredevents\"<\/a><\/p>\n

All the event details are available in the event description:
\n\"event<\/a><\/p>\n

One of the advantages of Event Log Explorer is Custom Columns feature. It lets you extract information from the event details and display it as a column in the event list.
\nLet\u2019s add user name and logon type to the list:<\/p>\n

Select View->Custom columns from the main menu<\/p>\n

Adding User Name:<\/strong><\/p>\n

Give a name of the column (e.g. User Name<\/strong><\/em>)<\/p>\n

You can set Event source to Microsoft-Windows-Security-Auditing<\/strong><\/em> and Event ID(s) to 4624, 4625<\/strong><\/em>, but since the log already filtered by these parameters you may leave these fields blank.<\/p>\n

Now you should set Value.<\/p>\n

There is a difference in event description between\u00a0events 4624 and 4625:<\/p>\n

New Logon:<\/span>\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \u2026\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Account Name:\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Administrator\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Account Domain:\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 MIKE-HP<\/pre>\n
Account For Which Logon Failed:<\/span>\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \u2026\r\n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Account Name:\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0Administrator\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Account Domain:\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0localhost<\/pre>\n
So, Account Name or Domain cannot be referenced by name, but fortunately they\u00a0have the same index number, so we can reference them by index:
\ntype
\n{PARAM[7]}\\{PARAM[6]}
\n<\/strong><\/em>In Value field.
\n\"custom<\/a><\/p>\n
Adding Logon Type<\/strong><\/p>\n
In Custom Columns dialog switch to Column 2.<\/strong><\/p>\n
Give a name of the column (e.g. Logon Type<\/strong><\/em>).<\/p>\n
You may leave Event Source and Event IDs empty.<\/p>\n
Type {Logon Type} <\/strong>
\nin Value filed.<\/p>\n
Press OK in Custom Columns dialog.
\n\"Events<\/a><\/p>\n
To make the view more perfect, remove useless User column:
\nSelect View->Configure Columns and switch User off.<\/p>\n
Now you can see\u00a0that we have several successful interactive logons (Logon Type=2), two\u00a0logons by a service (Logon Type=5) and a lot of failed logon attempts with Logon Type = 3 (Network logon).<\/p>\n
Let’s check from which computers\u00a0somebody tried to connect to our host:<\/p>\n
Select View->Custom Columns from the menu.<\/p>\n
Switch to Column 3<\/strong><\/p>\n
Give a name of the column (e.g. Remote Station<\/strong><\/em>).<\/p>\n
Set\u00a0Event IDs to 4625<\/strong> <\/em>(we need this information for invalid logon attempts only)<\/p>\n
Type {Network Information\\Workstation Name}<\/em>\u00a0<\/strong>
\nin Value filed.<\/p>\n
Press OK.
\n\"Remote<\/a><\/p>\n
Now we can find an invalid logon attempt from a remote workstation, but we also found many network logon attempts from our local computer.<\/p>\n
Security event log contains information about the process that attempted to logon. We can also display it as a custom column:<\/p>\n
Select View->Custom Columns from the main menu.<\/p>\n
Switch to Column 4.<\/strong><\/p>\n
Give a name of the column (e.g. Caller Process<\/strong><\/em>).<\/p>\n
Set\u00a0Event IDs to <\/span>4625<\/strong> <\/em>(we need this for logon attempts only)<\/span><\/p>\n
Type {Process Information\\Caller Process Name}<\/em><\/strong>
\nin Value filed.<\/p>\n
Press OK.
\n\"4625-caller<\/a><\/p>\n
So, now we can see which local processes tried to logon the system as Administrator, from which workstations users tried to logon our system and who and when logged on successfully and other logging on details.<\/p>\n\"Facebook\"<\/a>\"twitter\"<\/a>\"reddit\"<\/a>\"pinterest\"<\/a>\"linkedin\"<\/a>\"mail\"<\/a>","protected":false},"excerpt":{"rendered":"
One of the most important tasks in the security event log analysis is to find out who or what logs your system on. Here I will explain how Event Log Explorer helps you to solve this task. First, you need to make sure that Windows security auditing is enabled for logon events. You can do this using Local Security Policy or Group Policy, depending on\u2026 Read More »<\/a><\/span><\/p>\n","protected":false},"author":2,"featured_media":187,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[40,2],"tags":[51,19,49,23,16,22,4,15,17,18],"amp_enabled":true,"_links":{"self":[{"href":"https:\/\/eventlogxp.com\/blog\/wp-json\/wp\/v2\/posts\/12"}],"collection":[{"href":"https:\/\/eventlogxp.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/eventlogxp.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/eventlogxp.com\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/eventlogxp.com\/blog\/wp-json\/wp\/v2\/comments?post=12"}],"version-history":[{"count":1,"href":"https:\/\/eventlogxp.com\/blog\/wp-json\/wp\/v2\/posts\/12\/revisions"}],"predecessor-version":[{"id":77,"href":"https:\/\/eventlogxp.com\/blog\/wp-json\/wp\/v2\/posts\/12\/revisions\/77"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/eventlogxp.com\/blog\/wp-json\/wp\/v2\/media\/187"}],"wp:attachment":[{"href":"https:\/\/eventlogxp.com\/blog\/wp-json\/wp\/v2\/media?parent=12"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/eventlogxp.com\/blog\/wp-json\/wp\/v2\/categories?post=12"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/eventlogxp.com\/blog\/wp-json\/wp\/v2\/tags?post=12"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}