topic Re: How to track domain logons from DC security logs? in Getting Data In

How to track domain logons from DC security logs?

johann2017 — Thu, 23 Feb 2017 21:10:18 GMT

I want to be able to track domain logons from our DC security logs. I am monitoring Event 4624, but the DC security logs only seem to provide domain member authentication for Type 3 logons. What are others using for this?

Re: How to track domain logons from DC security logs?

DalJeanis — Thu, 23 Feb 2017 22:54:25 GMT

Depends on how homogeneous your network and your user base are. Check for these and see what you find.

(EventID=528 OR EventID=540 OR EventID=552 OR EventID=4624 OR EventID=4648)

Whether the individual workstations are going to forward their logs of type 7 events, whether you have technical users that will be using runas and generating type 9s, logging on through VPN and generating type 10s, not to mention whether there is any KVM/IP going on and generating pseudo-Type 2s, and so on, is highly organization-specific.

Re: How to track domain logons from DC security logs?

johann2017 — Tue, 28 Feb 2017 19:44:45 GMT

Thanks I will experiment with your suggestion!

Re: How to track domain logons from DC security logs?

DalJeanis — Tue, 28 Feb 2017 20:50:51 GMT

Oh, and that's for windows; unix logons have a whole different set of criteria. As a place to start, look for stuff like this -

((pam_vas:* AND "<succeeded") OR "Accepted" OR "Auth_methods_completed")