I'm trying to detect a user login event in Windows DC (Win Server 2012), but i'm having the following issues:

  • The event 4624 is not really certain because it might be automatically generated. For example when the Group Policy is automatically refreshed.

  • The local computer might have cached the credentials for the user so the user logon is not detected by the DC.

My main goal is to detect when a user access to his computer outside from work hours, that is user having activity between 22pm-7am. Also, my only data source is .evtx files generated in Domain Controller.

  • 4
    Something to consider potentially would be to make the user accounts use a login script and add some logic in that to have something put into a log file on a hidden share or something. Another thing to consider is to disallow login at specific times for specific accounts in AD Users and Computers if they are not supposed to log in during those times you can actually enforce a policy to prevent that entirely instead of having to dig in a log, find out who did this, report it or talk to them about it, etc. after the fact. Just a couple quick thoughts on the topic. Jul 7 '17 at 12:54
  • 1
    Do you have more than one DC? If so, you'd have to monitor all of them for logon events unless you can guarantee which DC will be used to authenticate the user. Jul 8 '17 at 18:41
  • If your only data source is event log data from a DC, then you do not have access to enough information to capture all relevant logon events. Are you certain you cannot include events captured by the user's workstation in your query? Jul 10 '17 at 16:08
  • There are many workstations, i might think in a solution using a log hub, is that posible without using third party tools?
    – DiegoS
    Jul 10 '17 at 18:59
  • Diego - You say "My main goal is to detect when a user access to his computer outside from work hours" so I'm curious what will be done with this data you gather that has the logins during these non-work hours? Additionally, you could setup a login script to run that if it cannot find the DC or hidden share that it logs to a local log file, & then have logic in there that also states if the hidden share is available, copy over the latest local login file to the same share but a separate subfolder perhaps and have the log name be %computername%.log perhaps.This would show cached logins. Jul 10 '17 at 20:32

As you stated, the DC does not capture logins on a remote computer with cached credentials, as the computer may not always be physically connected to the domain. Instead, you'll have to check his computer directly while his computer is online.

You can use the Event Viewer or the wevtutil command at a command prompt to manage event logs on a remote computer.

  1. Start Event Viewer.
  2. Click the root node, for example Event Viewer (Local), in the console tree.
  3. On the Action menu, click Connect to Another Computer
  4. In the Another computer box, type the name or IP address of the remote computer.
  5. (Optional) Select Connect as another user, click Set User, enter the User name and Password, and then click OK
  6. Click OK

Source: Work with Event Logs on a Remote Computer - Microsoft TechNet

Search for Event 4648 - A logon was attempted using explicit credentials on his computer.

As the description says, it is only when a logon uses explicit credentials. This event is generated on logging in or unlocking even with saved credentials (ie: Remote Desktop).

Note: As with any event, you can do additional filtering to remove any automatically generated events (less common with 4648 and username). The GUI (on the Filter tab) provides filtering on some fields. Using the XML tab, you can filter on any field within the event.

  • 4648 is not getting the login from the workstations in the domain, it's just getting the logins that are explicitly in the Server (DC).
    – DiegoS
    Jul 6 '17 at 13:27
  • You will likely have to check logs on his computer. See edited answer.
    – Steven
    Jul 8 '17 at 21:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.