ZEKASTRA

SecurityLogon and session

4624 · An account was successfully logged on

Generated on the computer that was accessed when a logon session is created. Records who logged on, the logon type, the authentication package and, for network logons, the source workstation and address.

01Fields in the event

  • SubjectUserName
  • SubjectLogonId
  • TargetUserSid
  • TargetUserName
  • TargetDomainName
  • TargetLogonId
  • LogonType
  • LogonProcessName
  • AuthenticationPackageName
  • WorkstationName
  • LogonGuid
  • ProcessName
  • IpAddress
  • IpPort
  • RestrictedAdminMode
  • TargetLinkedLogonId
  • ElevatedToken

02How to use it

Read LogonType first, then pair TargetLogonId with 4634/4647 to bound the session and with 4672 to see privileged logons. For remote access, compare IpAddress and WorkstationName with 4778/4779 and RDP events 21/24/25.

Logon type table in the guide

03Caveats

Requires Audit Logon. A logon session does not prove that a particular person was at the keyboard.

05Sources

  1. Microsoft Learn — 4624(S) An account was successfully logged on checked 2026-10-18

Contact and service requests

Contact us about examination services related to this page, support for expert witnesses, or collaboration. Please do not attach evidence files or personal data to your email.