Help shat does this mean?

  • System
  • Provider

[Name] Microsoft-Windows-Security-Auditing
[Guid] {54849625-5478-4994-a5ba-3e3b0328c30d}

EventID 4624

Version 2

Level 0

Task 12544

Opcode 0

Keywords 0x8020000000000000

  • TimeCreated

[SystemTime] 2019-10-05T08:03:44.907468600Z

EventRecordID 22969

  • Correlation

[ActivityID] {52026811-7a56-0003-8168-0252567ad501}

  • Execution

[ProcessID] 804
[ThreadID] 5960

Channel Security

Computer Zaney


  • EventData

SubjectUserSid S-1-5-18
SubjectUserName ZANEY$
SubjectDomainName WORKGROUP
SubjectLogonId 0x3e7
TargetUserSid S-1-5-18
TargetUserName SYSTEM
TargetDomainName NT AUTHORITY
TargetLogonId 0x3e7
LogonType 5
LogonProcessName Advapi
AuthenticationPackageName Negotiate
WorkstationName -
LogonGuid {00000000-0000-0000-0000-000000000000}
TransmittedServices -
LmPackageName -
KeyLength 0
ProcessId 0x2d0
ProcessName C:\Windows\System32\services.exe
IpAddress -
IpPort -
ImpersonationLevel %%1833
RestrictedAdminMode -
TargetOutboundUserName -
TargetOutboundDomainName -
VirtualAccount %%1843
TargetLinkedLogonId 0x0
ElevatedToken %%1842

1 Like

We are happy you are here! You are more likely to get a useful response if you are explicit about what your project entails, giving a few more details might help someone give you a nudge in the right directions.

Googling “microsoft-windows-security-auditing 4624” suggests it is a successful login.

Login Type 5 means a service startup.

1 Like