// REFERENCE
4624 — Successful logon
Log: Security
Low risk
A logon to the machine succeeded. The key field is the Logon Type: 2 (interactive), 3 (network, e.g. SMB), 10 (RDP), 5 (service). Pairing the type with the account and source IP separates routine access from suspicious access.
Hunt for: type 3/10 logons fanning out to many hosts from one account, or service-account logons outside their usual pattern.
Related tools
Work with this in:
Related
4625
4625 — Failed logon 4634
4634 — Logoff 4647
4647 — User-initiated logoff 4800
4800 — Workstation locked 4801
4801 — Workstation unlocked 4778
4778 — Session reconnected (RDP)
4625 — Failed logon 4634
4634 — Logoff 4647
4647 — User-initiated logoff 4800
4800 — Workstation locked 4801
4801 — Workstation unlocked 4778
4778 — Session reconnected (RDP)
Original descriptions based on Microsoft's public documentation. IDs and fields may vary with the Windows version and the active audit policy.