Why are there Splunk wineventlog?

[BryanLim]

Hi All, urgent help here. I check whether is any activity done by a user on a client machine, so i use this query in splunk search - [host="domain controller's server name" "user's account name"]. From the result, I see that there is multiple login/logout session within seconds and multiple Kerberos. I can confim that there is no physical user that is using the client machine. So can i ask why there is still wineventlogs (login/logout)?

[caiosalonso]

Hi @BryanLim ,

I Agree with @PickleRick, this does't seem to be related to Splunk. Actually, I guess there are lots of reasons that could make this occur in a Windws host, such as the user perviously authenticated and the session was not ended, services running authenticated on that machine and so on. 

[PickleRick]

It's not really a Splunk related question. It's more like a material for a discussion with your windows admins.

For starters you can look into https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/basic-audit-logon-even...