Which Windows Event IDs does the Workstation Logon Audit Agent use? (4235320)

Return

Feedback Submitted

Did this article solve an issue for you?

Select Rating

Title

Which Windows Event IDs does the Workstation Logon Audit Agent use?
Description

Which Event IDs are used to determine logon and logoff events?
Resolution
- Logon: Event ID 4624 with the Logon Type in the body of the event determining if it was an Interactive or Remote logon
- Logoff: Event ID 4647
- Locked: 4800
- Unlocked: 4801

Feedback Submitted

Did this article solve an issue for you?

Select Rating

Title