How to distingusion where is the 4624 event was logged, on workstation AD or remote host?


Hi Everyone

I am trying to detect RDP connection to a remote host. I read up some web post suggests looking for 4624 with logon type 10 event. I made an RDP to a remote host, however all 4624 evens I can see is logon type 3.

Then I realize 4624 events can be collected from 3 places

The workstation where the user phycially present

The AD: where the authentication takes place

The remote host: where the user wants to log in, which is the destination host.

I am wondering whether the logon type 10 events only occur on the remote host and on the AD log the 4624 event will have logon type 3 instead.

Anyone has come across this kind of situation before?

Thank you for the help.



Labels (1)
0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.