Event ID 4634 - An account was logged off

Event ID 4634 - An account was logged off

Json log sample:

{

"EventTime": "2017/08/25 14:09:12"

"Hostname": "MPWXDC.changeme.local"

"Keywords": -9214364837600034816

"EventType": "AUDIT_SUCCESS"

"SeverityValue": 2

"Severity": "INFO"

"EventID": 4634

"SourceName": "Microsoft-Windows-Security-Auditing"

"ProviderGuid": "{54849625-5478-4994-A5BA-3E3B0328C30D}"

"Version": 0

"Task": 12545

"OpcodeValue": 0

"RecordNumber": 614393726

"ProcessID": 824

"ThreadID": 14128

"Channel": "Security"

"Message": "An account was logged off."

"Category": "Logoff"

"Opcode": "Info"

"TargetUserSid": "S-1-5-21-343361891-1219768270-4058147650-8884"

"TargetUserName": "MPWXEX2013-1$"

"TargetDomainName": "MP"

"TargetLogonId": "0x30cdec610"

"LogonType": "3"

"EventReceivedTime": "2017/08/25 14:09:12"

"SourceModuleName": "wineventlog_in"

"SourceModuleType": "im_msvistalog"

}

This event is very important and highly valuable. It documents user logoff event from the local computer. This event returns the end of logon session and it can be correlated back to 4624 using TargetLogonId to find user session duration. However, in case of interactive logon, windows logs 4647 when user logoff is seen.

Target User Information:
"TargetUserSid" -> SID of an account
"TargetUserName" -> user who logged in
"TargetDomainName" -> domain name of user
"TargetLogonId" -> This is unique number between each reboot and it identifies each logon  session.
This provides an information about the user who just logged. To determine whether the account is local or domain compare TargetDomainName to the computer name.  If they match, the account is a local account on that system, otherwise a domain account.

Type of logon:
"LogonType" -> This defines the type of logon. Possible values are as follows

	logon_type	description
	2	Interactive
	3	Network
	4	Batch
	5	Service
	7	Unlock
	8	NetworkCleartext
	9	NewCredentials
	10	RemoteInteractive
	11	CachedInteractive

Event ID 4624 - An account was successfully logged on

Event ID 4624 - An account was successfully logged on

Json log sample:

{

"EventTime": "2017-10-09 05:00:00",

"Hostname": "LPWXDC.ChangeMe.local",

"Keywords": -9214364837600034816,

"EventType": "AUDIT_SUCCESS",

"SeverityValue": 2,

"Severity": "INFO",

"EventID": 4624,

"SourceName": "Microsoft-Windows-Security-Auditing",

"ProviderGuid": "{54849625-5478-4994-A5BA-3E3B0328C30D}",

"Version": 1,

"Task": 12544,

"OpcodeValue": 0,

"RecordNumber": 409583434,

"ProcessID": 824,

"ThreadID": 19048,

"Channel": "Security",

"Message": "An account was successfully logged on.",

"Category": "Logon",

"Opcode": "Info",

"SubjectUserSid": "S-1-0-0",

"SubjectUserName": "-",

"SubjectDomainName": "-",

"SubjectLogonId": "0x0",

"TargetUserSid": "S-1-5-18",

"TargetUserName": "LPW",

"TargetDomainName": "LP",

"TargetLogonId": "0x1828eb397",

"LogonType": "3",

"LogonProcessName": "Kerberos",

"AuthenticationPackageName": "Kerberos",

"LogonGuid": "{FD1B49BA-A5E9-5D7D-D3F4-D925B43807F2}",

"TransmittedServices": "-",

"LmPackageName": "-",

"KeyLength": "0",

"ProcessName": "-",

"WorkstationName": "LPLONSERVDBVM",

"IpAddress": "10.0.2.10",

"IpPort": "60208",

"ImpersonationLevel": "%%1833",

"EventReceivedTime": "2017-10-09 05:00:00",

"SourceModuleName": "wineventlog_in",

"SourceModuleType": "im_msvistalog"

}

This event is very important and highly valuable. It documents all successful attempt to logon to the local computer regardless of logon type, location of the user or type of account.

Subject User Information:
"SubjectUserSid"
"SubjectUserName"
"SubjectDomainName"
"SubjectLogonId"
This provides an information of account that request logon but not the actual user who logged on. This information are in general not that important from audit perspective but still there could be some cases where you would want to look into this. To find information regarding user who logged on we need to refer to Target User Information as below.

Target User Information:
"TargetUserSid" -> SID of an account
"TargetUserName" -> user who logged in
"TargetDomainName" -> domain name of user
"TargetLogonId" -> This is unique number between each reboot and it identifies each logon  session. This can be used to correlate with logoff events 4634, 4647.
This provides an information about the user who just logged. To determine whether the account is local or domain compare TargetDomainName to the computer name.  If they match, the account is a local account on that system, otherwise a domain account.

Type of logon:
"LogonType" -> This defines the type of logon. Possible values are as follows

	logon_type	description
	2	Interactive
	3	Network
	4	Batch
	5	Service
	7	Unlock
	8	NetworkCleartext
	9	NewCredentials
	10	RemoteInteractive
	11	CachedInteractive

Impersonation Level:

	impersonation level	description
	%%1832	Identification
	%%1833	Impersonation
	%%1840	Delegation
	%%1841	Denied by Process Trust Label ACE
	%%1842	Yes
	%%1843	No
	%%1844	System
	%%1845	Not Available
	%%1846	Default
	%%1847	DisallowMmConfig
	%%1848	Off
	%%1849	Auto

Network Information:

"IpAddress" -> IP address of the computer where the user is physically present
"IpPort" -> source TCP port of the logon request

"WorkstationName" -> the computer name of the computer where the user is physically present.  Workstation may be blank in some Kerberos logons.

Event ID 4625 - An account failed to logon

Event ID 4625 - An account failed to logon

Json log sample:

{

"EventTime": "2017/08/25 14:09:12"

"Hostname": "CIVDCS-ADC1.changeme.com"

"Keywords": -9218868437227405312

"EventType": "AUDIT_FAILURE"

"SeverityValue": 4

"Severity": "ERROR"

"EventID": 4625

"SourceName": "Microsoft-Windows-Security-Auditing"

"ProviderGuid": "{54849625-5478-4994-A5BA-3E3B0328C30D}"

"Version": 0

"Task": 12544

"OpcodeValue": 0

"RecordNumber": 56611365

"ProcessID": 528

"ThreadID": 4672

"Channel": "Security"

"Message": "An account failed to log on."

"Category": "Logon"

"Opcode": "Info"

"SubjectUserSid": "S-1-0-0"

"SubjectUserName": "-"

"SubjectDomainName": "-"

"SubjectLogonId": "0x0"

"TargetUserSid": "S-1-0-0"

"TargetUserName": "MININT-UP26I95$"

"TargetDomainName": "changeme"

"Status": "0xc000006d"

"FailureReason": "%%2313"

"SubStatus": "0xc000006a"

"LogonType": "3"

"LogonProcessName": "NtLmSsp "

"AuthenticationPackageName": "NTLM"

"WorkstationName": "MININT-UP26I95"

"TransmittedServices": "-"

"LmPackageName": "-"

"KeyLength": "0"

"ProcessName": "-"

"IpAddress": "172.23.130.64"

"IpPort": "65284"

"EventReceivedTime": "2017/08/25 14:09:12"

"SourceModuleName": "wineventlog_in"

"SourceModuleType": "im_msvistalog"

}

This event is very important and highly valuable. It documents all failed attempt to logon to the local computer regardless of logon type, location of the user or type of account.

Subject User Information:
"SubjectUserSid"
"SubjectUserName"
"SubjectDomainName"
"SubjectLogonId"
This provides an information of account that request logon but not the actual user who logged on. This information are in general not that important from audit perspective but still there could be some cases where you would want to look into this. To find information regarding user who logged on we need to refer to Target User Information as below.

Target User Information:
"TargetUserSid" -> SID of an account
"TargetUserName" -> user who logged in
"TargetDomainName" -> domain name of user
"TargetLogonId" -> This is unique number between each reboot and it identifies each logon  session.
This provides an information about the user who just logged. To determine whether the account is local or domain compare TargetDomainName to the computer name.  If they match, the account is a local account on that system, otherwise a domain account.

Type of logon:
"LogonType" -> This defines the type of logon. Possible values are as follows

	logon_type	description
	2	Interactive
	3	Network
	4	Batch
	5	Service
	7	Unlock
	8	NetworkCleartext
	9	NewCredentials
	10	RemoteInteractive
	11	CachedInteractive

Status and Sub Status Code:

status and sub_status_code	description
0XC000005E	There are currently no logon servers available to service the logon request.
0xC0000064	user name does not exist
0xC000006A	user name is correct but the password is wrong
0XC000006D	This is either due to a bad username or authentication information
0XC000006E	Unknown user name or bad password.
0xC000006F	user tried to logon outside his day of week or time of day restrictions
0xC0000070	workstation restriction or Authentication Policy Silo violation (look for event ID 4820 on domain controller)
0xC0000071	expired password
0xC0000072	account is currently disabled
0XC00000DC	Indicates the Sam Server was in the wrong state to perform the desired operation.
0xC0000133	clocks between DC and other computer too far out of sync
0xc000015b	The user has not been granted the requested logon type (aka logon right) at this machine
0XC000018C	The logon request failed because the trust relationship between the primary domain and the trusted domain failed.
0XC0000192	An attempt was made to logon but the netlogon service was not started.
0XC0000193	account expiration
0XC0000224	user is required to change password at next logon
0xC0000225	evidently a bug in Windows and not a risk
0xC0000234	user is currently locked out
0XC0000413	Logon Failure: The machine you are logging onto is protected by an authentication firewall. The specified   account is not allowed to authenticate to the machine.

Failure Reason:

			Failure reason	information
			%%2305	The specified user account has expired.
			%%2309	The specified account's password has expired.
			%%2310	Account currently disabled.
			%%2311	Account logon time restriction violation.
			%%2312	User not allowed to logon at this computer.
			%%2313	Unknown user name or bad password.

Network Information:

"IpAddress" -> IP address of the computer where the user is physically present
"IpPort" -> source TCP port of the logon request

"WorkstationName" -> the computer name of the computer where the user is physically present.  Workstation may be blank in some Kerberos logons.

Why should you monitor this event?

• To detect brute-force, dictionary, and other password guess attacks. Monitor sudden spike in failed logons.
• To detect abnormal and possible malicious internal activity. Monitor a logon attempt from a disabled account or unauthorized workstation, users logging on outside of normal working hours, etc.
• To benchmark Account lockout threshold policy setting. Determine number of failed login attempts before a user account gets locked.
• To comply with regulatory mandates precise information surrounding failed logons is necessary.

Event ID 4769 - A Kerberos service ticket was requested

Event id 4769 - A Kerberos service ticket was requested

Json log sample

{

 "EventTime": "2017/11/17 04:04:12"

 "Hostname": "MPWXDC.changeme.local"

 "Keywords": -9214364837600034816

 "EventType": "AUDIT_SUCCESS"

 "SeverityValue": 2

 "Severity": "INFO"

 "EventID": 4769

 "SourceName": "Microsoft-Windows-Security-Auditing"

 "ProviderGuid": "{54849625-5478-4994-A5BA-3E3B0328C30D}"

 "Version": 0

 "Task": 14337

 "OpcodeValue": 0

 "RecordNumber": 614391031

 "ProcessID": 824

 "ThreadID": 25536

 "Channel": "Security"

 "Message": "A Kerberos service ticket was requested."

 "Category": "Kerberos Service Ticket Operations"

 "Opcode": "Info"

 "TargetUserName": "Ann Marchant@changeme.LOCAL"

 "TargetDomainName": "changeme.LOCAL"

 "ServiceName": "MPWX04"

 "ServiceSid": "S-1-5-21-343361891-1219768270-4058147650-3809"

 "TicketOptions": "0x40810000"

 "TicketEncryptionType": "0x12"

 "IpAddress": "::ffff:172.16.0.97"

 "IpPort": "61235"

 "Status": "0x0"

 "LogonGuid": "{CCD4CD7D-0391-9A75-1ACD-E8707F826A29}"

 "TransmittedServices": "-"

 "EventReceivedTime": "2017/11/17 04:04:12"

 "SourceModuleName": "wineventlog_in"

   "SourceModuleType": "im_msvistalog"

}

This event ID is logged both for successful and failed service ticket requests. In case of failure event various status code are generated as shown below. Event ID 4768 tracks initial logons through the granting of TGTs whereas 4769 monitors granting of service tickets. Service tickets are obtained whenever a user or computer accesses a server on the network.

Note: Windows logs other instances of event ID 4768 when a computer in the domain needs to authenticate to the DC typically when a workstation boots up or a server restarts. In these instances, you'll find a computer name in the User Name and fields. Computer generated kerberos events are always identifiable by the $ after the computer account's name.

Target User Information:

"TargetUserSid" -> SID of an account

"TargetUserName" -> user who logged in

"TargetDomainName" -> domain name of user

This provides an information about the user who was just granted an authentication.

Status:

status	reason		description
0x0	No error
0x1	Client's entry in database has expired
0x2	Server's entry in database has expired
0x3	Requested protocol version # not supported
0x4	Client's key encrypted in old master key
0x5	Server's key encrypted in old master key
0x6	Client not found in Kerberos database		Bad user name, or new computer/user account has not replicated to DC yet
0x7	Server not found in Kerberos database		New computer account has not replicated yet or computer is pre-w2k
0x8	Multiple principal entries in database
0x9	The client or server has a null key		administrator should reset the password on the account
0xA	Ticket not eligible for postdating
0xB	Requested start time is later than end time
0xC	KDC policy rejects request		Workstation restriction
0xD	KDC cannot accommodate requested option
0xE	KDC has no support for encryption type
0xF	KDC has no support for checksum type
0x10	KDC has no support for padata type
0x11	KDC has no support for transited type
0x12	Clients credentials have been revoked		Account disabled, expired, locked out, logon hours.
0x13	Credentials for server have been revoked
0x14	TGT has been revoked
0x15	Client not yet valid - try again later
0x16	Server not yet valid - try again later
0x17	Password has expired		The user's password has expired.
0x18	Pre-authentication information was invalid		Usually means bad password
0x19	Additional pre-authentication required*
0x1F	Integrity check on decrypted field failed
0x20	Ticket expired		Frequently logged by computer accounts
0x21	Ticket not yet valid
0x21	Ticket not yet valid
0x22	Request is a replay
0x23	The ticket isn't for us
0x24	Ticket and authenticator don't match
0x25	Clock skew too great		Workstations clock too far out of sync with the DCs
0x26	Incorrect net address		IP address change?
0x27	Protocol version mismatch
0x28	Invalid msg type
0x29	Message stream modified
0x2A	Message out of order
0x2C	Specified version of key is not available
0x2D	Service key not available
0x2E	Mutual authentication failed		may be a memory allocation failure
0x2F	Incorrect message direction
0x30	Alternative authentication method required*
0x31	Incorrect sequence number in message
0x32	Inappropriate type of checksum in message
0x3C	Generic error (description in e-text)
0x3D	Field is too long for this implementation

Network Information:

"IpAddress" -> IP address of the computer where the user is physically present

"IpPort" -> source TCP port of the logon request

"WorkstationName" -> the computer name of the computer where the user is physically present.  Workstation may be blank in some Kerberos logons.