Fix Event ID 4624, An account was successfully logged on
0Here's how to Fix Event ID 4624, An account was successfully logged on.
i. Here are a few ways to monitor user logon activities in Windows:
- Event Viewer - Check the Security log in Event Viewer for Logon/Logoff events with event IDs like 4624, 4634. This logs user logons, failures, logoffs.
- Logon Reports - Generate logon reports in Active Directory Users and Computers. Right click domain - View Logon Reports.
- PowerShell - Run 'Get-WinEvent -FilterHashtable @{LogName='Security';ID=4624}' to fetch logons via PowerShell.
- Login auditing - Enable "Audit logon events" auditing under Local Security Policy or Group Policy. Logs user and type of logon.
- Account Logon Events - Enable "Account Logon Events" monitoring under Windows Advanced Audit Policy Configuration to log all events.
- Logon Scripts - Create a simple logon script to output user, time and more to a logfile. Runs every time a user logs in.
- SIEM tools - Use Security Information and Event Management tools to analyze logs and create alerts.
- Change monitoring - Monitor permission and file changes in critical folders for suspicious activity.
- Third-party tools - Utilize tools like ManageEngine ADAudit Plus to log and report on logon history.
The key is enabling enhanced logging around account logon events and user authentication. Consult event logs regularly to establish a baseline of normal activity.