none
Security Event ID To track Logons

    Question

  • Hello. From within my Domain Controller Security Log, what Event ID(s) could be used to track when there is a logon to any member computer in the domain? For instance, if someone where to RDP into a domain joined SQL Database server, what Event ID from my DC security log could be used to track that?
    Monday, February 27, 2017 9:35 PM

Answers

All replies

  • Hi,

    >>what Event ID(s) could be used to track when there is a logon to any member computer in the domain

    528 / 4624  LOGON
    538 / 4634  LOGOFF

    Configuring Audit Policies

    https://technet.microsoft.com/en-us/library/dd277403.aspx

    Best regards,

    Andy


    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Tuesday, February 28, 2017 2:45 AM
    Moderator
  • Hello. From within my Domain Controller Security Log, what Event ID(s) could be used to track when there is a logon to any member computer in the domain? For instance, if someone where to RDP into a domain joined SQL Database server, what Event ID from my DC security log could be used to track that?

    I go for 4769. These events log on DC which user was authenticated to. Tell me and example of what you are trying to achieve?


    Mahdi Tehrani   |     |   www.mahditehrani.ir
    Please click on Propose As Answer or to mark this post as and helpful for other people.
    This posting is provided AS-IS with no warranties, and confers no rights.

    Tuesday, February 28, 2017 7:51 AM
    Moderator