Global Security Forum

Security Global Forum

Our mission is to provide clients with an online user community of industry peers and IBM experts, to exchange tips and tricks, best practices, and product knowledge. We hope the information you find here helps you maximize the value of your IBM Security solutions.

 View Only
Back to discussions
Expand all | Collapse all

How to distingusion where is the 4624 event was logged, on workstation AD or remote host?

  • 1.  How to distingusion where is the 4624 event was logged, on workstation AD or remote host?

    Posted Wed January 06, 2021 12:12 AM
    Hi Everyone

    I am trying to detect RDP connection to a remote host. I read up some web post suggests looking for 4624 with logon type 10 event. I made an RDP to a remote host, however all 4624 evens I can see is logon type 3.

    Then I realize 4624 events can be collected from 3 places

    The workstation where the user phycially present

    The AD: where the authentication takes place

    The remote host: where the user wants to log in, which is the destination host.

    I am wondering whether the logon type 10 events only occur on the remote host and on the AD log the 4624 event will have logon type 3 instead.

    Anyone has come across this kind of situation before?

    Thank you for the help.

    Cheers

    Linsong

    ------------------------------
    Linsong Guo
    ------------------------------