• ポータルについて詳しく知る
• ダウンロード
• 印刷
• MY ダウンロード ()

• サポート
• 技術文書
• Change Auditor for Logon Activity 7.1.1
• Change Auditor for Logon Activity 7.1.1 - Event Reference Guide

Change Auditor for Logon Activity 7.1.1 - Event Reference Guide

コンテンツのナビゲーション  

Introduction Change Auditor for Logon Activity Events

Active Directory Federation Services - Sign-in Authentication Activity Domain Controller Authentication Logon Session

• Viewing Topics 5 - 6 of 6

×

Domain Controller Authentication

NOTE: Domain Controller Authentication events are only available with the Change Auditor for Logon Activity User auditing module. They are not available with the Change Auditor for Logon Activity Workstation auditing module.

NOTE: The following Domain Controller Authentication events do not require Windows system provided auditing enabled and are recorded in Change Auditor even if they are not recorded in the Windows Event log: • User authenticated through Kerberos • User failed to authenticate through Kerberos

 

Table 3. Domain Controller Authentication events

Event	Description	Severity
Kerberos user ticket that exceeds the maximum ticket lifetime detected	A Kerberos user ticket can be used to verify your identity and gain access to specific resources or services in your domain. A golden ticket is a forged Kerberos ticket. An attack using a golden ticket is extremely dangerous due to the forged identity, elevated access it allows, and because it can be reused over its lifetime (10 years by default). This event is created when the Kerberos Ticket Lifetime value in agent configuration is exceeded indicating a possible golden ticket attack.	High
User authenticated through Kerberos	Created when a user successfully authenticated to a domain controller using Kerberos authentication. (Disabled by default)	Medium
User failed to authenticate through Kerberos	Created when a user failed to authenticate to a domain controller using Kerberos authentication.	Medium
User authenticated through NTLM	Created when a user successfully authenticated to a domain controller using NTLM authentication. (Disabled by default)	Low
User failed to authenticate through NTLM	Created when a user failed to authenticate to a domain controller using NTLM authentication.	Medium

Logon Session

NOTE: Logon Session events for servers are available with the Change Auditor for Logon Activity User auditing module. Logon Session events for workstations require the Change Auditor for Logon Activity Workstation auditing module and workstation agents to be deployed to the workstations to be monitored.

 

Table 4. Logon Session events

Event	Description	Severity
A user session took place	Created when a user session took place on a monitored computer.	Medium
A user session was ended by the screensaver turning on	Created when a user session is ended because the screensaver turned on.	Medium
A user session was ended by user locking the computer	Created when a user session is ended because the user locked up the computer.	Medium
A user session was ended by user logging off	Created when a user session is ended because the user logged off.	Medium
A user session was ended by user stopping a terminal services connection	Created when a user session is ended because the user stopped a terminal services connection.	Medium
A user session was ended due to computer shutdown	Created when a user session is ended because a user has shut down or restarted the computer.	Medium
A user session was ended due to user switch	Created when a user session is ended because a different user has logged on.	Medium
A user session was started	Created when a user session is started on a monitored computer.	Medium
A user session was started before the start of the user session monitoring service	Created when a new user session is started before the user session monitoring service is started.	Medium
A user session was started by user exiting screensaver mode	Created when a new user session is started because the user exited the screensaver mode.	Medium
A user session was started by user making a terminal services connection	Created when a new user session is started because a user logged in through a terminal services connection.	Medium
A user session was started by user unlocking the computer	Created when a new user session is started because the user unlocked the computer.	Medium
A user session was started due to user switch	Created when a new user session is started because a different user has logged on.	Medium
An incorrectly finished user session was found	Created when an incorrectly finished user session is found when the user session monitoring service is started.	Medium

•  前回
• Viewing Topics 5 - 6 of 6
• 次へ 

この文書を検索 この製品バージョンに対応するすべての文書を検索 この製品に対応するすべての文書を検索 すべての文書を検索

×

 サポートへようこそ

Quest *product*のオンラインサポートヘルプは、関連会社のサポートサイトで参照できます。「Continue（続行）」をクリックすると、*product*の適切なサポートコンテンツとアシスタンスへ移動します。

関連ドキュメント

The document was helpful.

評価を選択

I easily found the information I needed.

評価を選択

© ALL RIGHTS RESERVED. 利用規約 プライバシー Cookie Preference Center