Help
cancel
Showing results for 
Search instead for 
Did you mean: 
Highlighted
Ground Controller Lvl 1
Message 1 of 3

Help shat does this mean?

+ System

- Provider

[ Name] Microsoft-Windows-Security-Auditing
[ Guid] {54849625-5478-4994-a5ba-3e3b0328c30d}

EventID 4624

Version 2

Level 0

Task 12544

Opcode 0

Keywords 0x8020000000000000

- TimeCreated

[ SystemTime] 2019-10-05T08:03:44.907468600Z

EventRecordID 22969

- Correlation

[ ActivityID] {52026811-7a56-0003-8168-0252567ad501}

- Execution

[ ProcessID] 804
[ ThreadID] 5960

Channel Security

Computer Zaney

Security

- EventData

SubjectUserSid S-1-5-18
SubjectUserName ZANEY$
SubjectDomainName WORKGROUP
SubjectLogonId 0x3e7
TargetUserSid S-1-5-18
TargetUserName SYSTEM
TargetDomainName NT AUTHORITY
TargetLogonId 0x3e7
LogonType 5
LogonProcessName Advapi
AuthenticationPackageName Negotiate
WorkstationName -
LogonGuid {00000000-0000-0000-0000-000000000000}
TransmittedServices -
LmPackageName -
KeyLength 0
ProcessId 0x2d0
ProcessName C:\Windows\System32\services.exe
IpAddress -
IpPort -
ImpersonationLevel %%1833
RestrictedAdminMode -
TargetOutboundUserName -
TargetOutboundDomainName -
VirtualAccount %%1843
TargetLinkedLogonId 0x0
ElevatedToken %%1842

2 Replies
Community Manager
Message 2 of 3

Re: Help shat does this mean?

We are happy you are here! You are more likely to get a useful response if you are explicit about what your project entails, giving a few more details might help someone give you a nudge in the right directions.


Best,
AndreaG

Mark helpful posts with Accept as Solution to help other users locate important info. Don't forget to give Kudos for great content!

Commander Lvl 2
Message 3 of 3

Re: Help shat does this mean?

Googling "microsoft-windows-security-auditing 4624" suggests it is a successful login.

 

Login Type 5 means a service startup.

 

Please follow-up to let us know how you made out. For good karma, mark a reply as the answer if it helped!