- A ton of Logon/off events in Event Viewer – Server Fault
I know that my DC should get a lot of 4624 and 4634 events, however I don't have any client PC's turned on at all. The other event, 4672, might be the problem in this case because my event o …
Filtering Security Logs by User and Logon Type – Server Fault
I have been asked to find out when a user has logged on to the system in the last week. Now the audit logs in Windows should contain all the info I need. I think if I search for Event ID 4624 (Lo…
Event 4634 is logged every 5 minutes – Server Fault
In the Windows Logs > Security Event log I see event 4634 (Logoff) followed by 4776 (Credential Validation), 4672 (Special Login) and 4624 (Login) The every 5 minutes thing must mean something…
Why would I have a 4624 (logon) and 4634 (logoff) event at …
While I was looking through the 4624 / 4634 events in the event log, I found that several times throughout the day there was a 4624 (logon) followed immediately by a 4634 (logoff). According to the ev …
Server 2019 – Very large number of logon events per second …
When I look in the Security Event log, I see thousands of Logon (Event ID 4624), Logoff (Event ID 4634 and Special Logon (Event ID 4672) events – hundreds per hour being generated.
Why am I only seeing logoff, but no login, events in Windows …
When I run Get-EventLog or Get-WinEvent and filter for Login (Event ID 4624) and Logoff (Event ID 4634) events, I only am seeing Logoff events with no corresponding Login events.
windows sbs 2008 – Disable audit of Logon Logoff – Server Fault
I have a SBS 08 with 50 users on my domain. In Event Viewer : Windows Logs > Security, I've got nearly 300,000 events about EventID 4624 Logon, 4634 Logoff, 4776 Credential Validation, 4769 Ke …
Why am I getting unauthorized errors with Powershell get …
I'm a domain admin equivalent, I've tried running in an elevated console (right-click> run as administrator), and I'm consistently getting errors when executing get-winevent -logname …
troubling anonymous Logon events in Windows Security event log
I have a dedicated server hosted on Rackspace Cloud, and this morning as I was casually checking the Security event log, I saw a series of successful Logon events that are troubling. It appears ra…
Is there a way to set access to WMI using GroupPolicy?
I hope people who are configuring GPOs to enable access to WMI have a firm enough understanding of these systems that they don't need to know exactly when or how many times to click "Ok …
コメント