Windows Event Log Experts - Identifying A User Login To Windows..How?

Posted on 2007-07-31
Last Modified: 2013-12-05
Hi Experts ,

i have a system which analyzes the windows event log ..parses it and inserts that to a db which i can read later on (sim product).

ive tried looking into windows events and analyze which windows events does the dc generate in a case of a logon to the domain.

im trying to see which events should i be aware of (672..680..etc) when a user logs in (NTLM AND Kerb) , more like which events are generated and in what form (for a false example say -  event 1 , then 300 , then 400 will indicate a user login...) , i know this is big to comprahand so ill make it even shorter.

im gonna make a rule who will notify me about interactive login at night (24:00 till morning) , which events should i catch and be sure - Joe did a login at 01:00..(then further on ill look what he did on other systems)..

Question by:m0tek
    LVL 63

    Accepted Solution

    It sounds like you already have the information from the logs.

    Just create rules for all the events, and also do some testing of your own to confirm.

    I hope this helps !

    LVL 70

    Expert Comment


    Featured Post

    Top 6 Sources for Identifying Threat Actor TTPs

    Understanding your enemy is essential. These six sources will help you identify the most popular threat actor tactics, techniques, and procedures (TTPs).

    Join & Write a Comment

    Welcome to my series of short tips on migrations. Whilst based on Microsoft migrations the same principles can be applied to any type of migration. My first tip is around source server preparation. No migration is an easy migration, there is a…
    On July 14th 2015, Windows Server 2003 will become End of Support, leaving hundreds of thousands of servers around the world that still run this 12 year old operating system vulnerable and potentially out of compliance in many organisations around t…
    Hi everyone! This is Experts Exchange customer support.  This quick video will show you how to change your primary email address.  If you have any questions, then please Write a Comment below!
    Illustrator's Shape Builder tool will let you combine shapes visually and interactively. This video shows the Mac version, but the tool works the same way in Windows. To follow along with this video, you can draw your own shapes or download the file…

    755 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    19 Experts available now in Live!

    Get 1:1 Help Now