戻る
-
タイトル
Which Windows Event IDs does the Workstation Logon Audit Agent use? -
説明
Which Event IDs are used to determine logon and logoff events? -
対策
- Logon: Event ID 4624 with the Logon Type in the body of the event determining if it was an Interactive or Remote logon
- Logoff: Event ID 4647
- Locked: 4800
- Unlocked: 4801