Showing results for 
Search instead for 
Did you mean: 
Ground Controller Lvl 1
Message 1 of 3

Help shat does this mean?

+ System

- Provider

[ Name] Microsoft-Windows-Security-Auditing
[ Guid] {54849625-5478-4994-a5ba-3e3b0328c30d}

EventID 4624

Version 2

Level 0

Task 12544

Opcode 0

Keywords 0x8020000000000000

- TimeCreated

[ SystemTime] 2019-10-05T08:03:44.907468600Z

EventRecordID 22969

- Correlation

[ ActivityID] {52026811-7a56-0003-8168-0252567ad501}

- Execution

[ ProcessID] 804
[ ThreadID] 5960

Channel Security

Computer Zaney


- EventData

SubjectUserSid S-1-5-18
SubjectUserName ZANEY$
SubjectDomainName WORKGROUP
SubjectLogonId 0x3e7
TargetUserSid S-1-5-18
TargetUserName SYSTEM
TargetDomainName NT AUTHORITY
TargetLogonId 0x3e7
LogonType 5
LogonProcessName Advapi
AuthenticationPackageName Negotiate
WorkstationName -
LogonGuid {00000000-0000-0000-0000-000000000000}
TransmittedServices -
LmPackageName -
KeyLength 0
ProcessId 0x2d0
ProcessName C:\Windows\System32\services.exe
IpAddress -
IpPort -
ImpersonationLevel %%1833
RestrictedAdminMode -
TargetOutboundUserName -
TargetOutboundDomainName -
VirtualAccount %%1843
TargetLinkedLogonId 0x0
ElevatedToken %%1842

2 Replies
Community Manager
Message 2 of 3

Re: Help shat does this mean?

We are happy you are here! You are more likely to get a useful response if you are explicit about what your project entails, giving a few more details might help someone give you a nudge in the right directions.


Mark helpful posts with Accept as Solution to help other users locate important info. Don't forget to give Kudos for great content!

Commander Lvl 2
Message 3 of 3

Re: Help shat does this mean?

Googling "microsoft-windows-security-auditing 4624" suggests it is a successful login.


Login Type 5 means a service startup.


Please follow-up to let us know how you made out. For good karma, mark a reply as the answer if it helped!