I work for a smaller company that has an IT guy that is a real hot-head, who thinks he’s God. I’ve noticed lately that I have a bunch of event ID 4624 (successful logon) events popping up in my Windows security event log with his user name. It doesn’t appear to be some scheduled job because they are random throughout the day. I’m seeing 10-20 of these logon events with the IT guy’s user name per day.
What could these logon events be?
If he is “secretly” logging on to my computer, how can I determine what he’s doing?
Here's a little snippet of the event text:
Log Name: Security Source: Microsoft-Windows-Security-Auditing Date: 5/14/2019 8:17:04 AM Event ID: 4624 Task Category: Logon Level: Information Keywords: Audit Success User: N/A Description: An account was successfully logged on. Subject: Security ID: NULL SID Account Name: - Account Domain: - Logon ID: 0x0 Logon Information: Logon Type: 3 Restricted Admin Mode: - Virtual Account: No Elevated Token: No New Logon: Security ID: domain\ITguyuser Account Name: ITguyuser Account Domain: domain