Event ID 4624: an account was successfully logged on

Event 4624 is written in the Security log every time an account logs on successfully: at the keyboard, over the network, by Remote Desktop, as a service. On a Server that is thousands a day. Most are harmless – the art is to find the few that are not, such as a Remote Desktop logon from an address you do not know, right after a series of failed logons (4625).

1. Where to find it

Event Viewer (eventvwr.msc) › Windows Logs › Security, filter for 4624. Windows writes it by default (audit subcategory Logon, Success). On a domain controller you see the logons at the domain controller – a user's logon at their own PC is logged on that PC.

2. The logon types

Type	Name	What it means
2	Interactive	At the keyboard (or a console session in Hyper-V / VMware).
3	Network	Access over the network: file shares, printers, remote management. With Network Level Authentication every RDP logon starts with a type 3.
4	Batch	A scheduled task.
5	Service	A service started under an account.
7	Unlock	The screen was unlocked (also a reconnect to a locked RDP session).
8	NetworkCleartext	The password went over the network in clear text, e.g. IIS Basic authentication. Should be rare.
9	NewCredentials	runas /netonly: other credentials for network access only.
10	RemoteInteractive	Remote Desktop.
11	CachedInteractive	Logon with cached domain credentials, no domain controller reachable (laptops).

3. The fields that matter

• New Logon › Account Name / Account Domain (TargetUserName, TargetDomainName): who logged on.
• Logon Type (LogonType): see the table above.
• Network Information › Source Network Address (IpAddress) and Workstation Name: where from. - or 127.0.0.1 means local.
• Authentication Package (AuthenticationPackageName): Kerberos, NTLM or Negotiate. NTLM V1 (LmPackageName) is outdated and should not appear.
• Elevated Token (ElevatedToken): the session has administrator rights.
• Process Name: which program asked for the logon, e.g. svchost.exe, winlogon.exe, w3wp.exe.

4. PowerShell: who logged on by Remote Desktop, and from where

As administrator. The helper reads the fields by name, so it works on every Windows language:

function Get-EventFields($e) { $d = [ordered]@{}; ([xml]$e.ToXml()).Event.EventData.Data | ForEach-Object { $d[$_.Name] = $_.'#text' }; [pscustomobject]$d }
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4624; StartTime=(Get-Date).AddDays(-7)} -ErrorAction SilentlyContinue |
  ForEach-Object { $f = Get-EventFields $_; if ($f.LogonType -eq '10') {
    [pscustomobject]@{ Time = $_.TimeCreated; User = "$($f.TargetDomainName)\$($f.TargetUserName)"; From = $f.IpAddress; Computer = $f.WorkstationName } } } |
  Format-Table -AutoSize

Change '10' to '3' for network logons. Logons from internet addresses, grouped:

Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4624; StartTime=(Get-Date).AddDays(-7)} -ErrorAction SilentlyContinue |
  ForEach-Object { Get-EventFields $_ } |
  Where-Object { $_.IpAddress -match '^\d' -and $_.IpAddress -notmatch '^(10\.|192\.168\.|172\.(1[6-9]|2\d|3[01])\.|127\.)' } |
  Group-Object IpAddress, TargetUserName, LogonType | Sort-Object Count -Descending | Select-Object Count, Name

5. Which successful logons should worry you

• Type 10 or 3 from an internet address you do not know – especially when the same address had failed logons (4625) just before: the password was guessed.
• An administrator account (Elevated Token = Yes) logging on from a new place or at an unusual time.
• A new account (Event 4720) that logs on shortly after it was created.
• Type 8 (clear text) or NTLM V1 at all.
• Type 9 on a Server where nobody uses runas /netonly – a known technique to use stolen credentials.

What to do: if the logon was not yours, end the session (query session, logoff <id>), change the account's password, block the address in the firewall and check what happened in the session (new accounts, new services – Event 7045, scheduled tasks – Event 4698).

6. Let Coinetic watch it for you

Coinetic watches the logon side of the Security log for you:

• Password guessers are banned automatically by a Windows Firewall rule after a few failed logons – for Remote Desktop, Windows logons and more – so a guessed password becomes much less likely.
• Remote Desktop invisible until you need it: the port stays closed and opens only after you unlock it from your phone.
• Ask AI (Pro + AI): “Is someone guessing passwords on this Server?” – answered in plain words from this computer's failed logons and bans.

More guides: all Coinetic guides.

Frequently asked

Why do I see a type 3 logon before every RDP logon?

With Network Level Authentication the client authenticates first over the network (type 3), then the desktop session starts (type 10, or 7 when you reconnect to a locked session). Both belong to the same Remote Desktop logon.

What is the difference between 4624 and 4625?

4624 is a successful logon, 4625 a failed one. Many 4625 from one address followed by a 4624 from the same address is the pattern of a guessed password.

Why are there so many 4624 entries with ANONYMOUS LOGON or SYSTEM?

Windows itself logs on constantly: services, the computer account, anonymous network queries. Filter them out and look at real user accounts and at the logon types 10 and 3 from outside.

Can I switch off Event 4624 to reduce noise?

Better not: it is the record of who got in. If the log is too noisy, make it bigger and filter when you read it.