Global Security Forum

 View Only
Expand all | Collapse all

How to distingusion where is the 4624 event was logged, on workstation AD or remote host?

  • 1.  How to distingusion where is the 4624 event was logged, on workstation AD or remote host?

    Posted Wed January 06, 2021 12:12 AM
    Hi Everyone

    I am trying to detect RDP connection to a remote host. I read up some web post suggests looking for 4624 with logon type 10 event. I made an RDP to a remote host, however all 4624 evens I can see is logon type 3.

    Then I realize 4624 events can be collected from 3 places

    The workstation where the user phycially present

    The AD: where the authentication takes place

    The remote host: where the user wants to log in, which is the destination host.

    I am wondering whether the logon type 10 events only occur on the remote host and on the AD log the 4624 event will have logon type 3 instead.

    Anyone has come across this kind of situation before?

    Thank you for the help.

    Cheers

    Linsong

    ------------------------------
    Linsong Guo
    ------------------------------