none
4624 Event Log Question Type3 and Process mmc.exe

    Question

  • Can someone tell me what is going on with these event logs?

    TargetUserName  SubjectUserName ProcessName Type    event_id    Process Workstation
     john           bill            mmc.exe     3       4625        Authz   IOSLTDCBILL
     john           bill            mmc.exe     3       4624        Authz   IOSLTDCBILL
     john           bill            mmc.exe             4648        
     mark           hank            mmc.exe     3       4625        Authz   IOSLTWSHANK
     mark           hank            mmc.exe     3       4624        Authz   IOSLTWSHANK
     mark           hank            mmc.exe             4648    
    

    Obviously, I changed the names of everything but are john and mark using the mmc console to access IOSLTDCBILL and IOSLTWSHANK?

    Saturday, May 5, 2018 3:49 PM

All replies

  • Hi,

    There is a detailed article about Event 4624,please refer to it.

    https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4624

    Type 3 Network A user or computer logged on to this computer from the network.

    Event 4648 

    This event is generated when a process attempts an account logon by explicitly specifying that account’s credentials.

    This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the “RUNAS” command.

    It is also a routine event which periodically occurs during normal operating system activity.



    Best Regards,
    Frank


    Please remember to mark the replies as an answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com

    • Proposed as answer by KHart85 Monday, May 7, 2018 1:22 PM
    Monday, May 7, 2018 2:32 AM
  • Hi,
    Just checking in to see if the information provided was helpful. Please let us know if you would like further assistance.

    Best Regards,

    Frank

    Please remember to mark the replies as an answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com

    Tuesday, May 8, 2018 7:24 AM
  • Hi,

    Was your issue resolved? 

    If you resolved it using our solution, please "mark it as answer" to help other community members find the helpful reply quickly.
    If you resolve it using your own solution, please share your experience and solution here. It will be very beneficial for other community members who have similar questions.
    If no, please reply and tell us the current situation in order to provide further help.


    Best Regards,
    Frank

    Please remember to mark the replies as an answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com

    Monday, May 14, 2018 8:50 AM