0

I work for a smaller company that has an IT guy that is a real hot-head, who thinks he’s God. I’ve noticed lately that I have a bunch of event ID 4624 (successful logon) events popping up in my Windows security event log with his user name. It doesn’t appear to be some scheduled job because they are random throughout the day. I’m seeing 10-20 of these logon events with the IT guy’s user name per day.

What could these logon events be?

If he is “secretly” logging on to my computer, how can I determine what he’s doing?

Here's a little snippet of the event text:

Log Name:      Security
Source:        Microsoft-Windows-Security-Auditing
Date:          5/14/2019 8:17:04 AM
Event ID:      4624
Task Category: Logon
Level:         Information
Keywords:      Audit Success
User:          N/A

Description:
An account was successfully logged on.

Subject:
    Security ID:        NULL SID
    Account Name:       -
    Account Domain:     -
    Logon ID:       0x0

Logon Information:
    Logon Type:     3
    Restricted Admin Mode:  -
    Virtual Account:        No
    Elevated Token:     No

New Logon:
    Security ID:        domain\ITguyuser
    Account Name:       ITguyuser
    Account Domain:     domain
Improve this question
7
  • In a PS command prompt, could you run: schtasks.exe /query /V /FO CSV | ConvertFrom-Csv | Where { $_."Run As User" -match "ITguyuser"} | select Taskname Anything returned?
    – HelpingHand
    May 14, 2019 at 20:01
  • Thanks HelpingHand. I tried your PS query and nothing was returned.
    – lmttag
    May 14, 2019 at 20:47
  • Maybe install sysmon to record a record of processes created, network connections made - docs.microsoft.com/en-us/sysinternals/downloads/sysmon
    – HelpingHand
    May 14, 2019 at 23:44
  • Hello. I set up sysmon and checked its logs after every time and they all appear to be the same (sorry if the formatting is not good):
    – lmttag
    May 15, 2019 at 22:10
  • Date: 5/15/2019 4:05:43 PM Event ID: 3 Task Category: Network connection detected (rule: NetworkConnect) Level: Information User: SYSTEM Computer: mycomputer Network connection detected: UtcTime: 2019-05-15 22:05:42.279 ProcessGuid: {81aca8ab-0cf0-5cdc-0000-0010eb030000} ProcessId: 4 Image: System User: NT AUTHORITY\SYSTEM Protocol: tcp Initiated: false SourceIsIpv6: false SourceIp: 10.20.38.2 (not my ip addr?) SourceHostname: mycomputer SourcePort: 445 SourcePortName: microsoft-ds
    – lmttag
    May 15, 2019 at 22:15

1 Answer 1

Reset to default
0

Based off this resource, it appears the IT guy is accessing some shared folder/files on your host.

https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4624

The Logon Type doesn't indicate they have an interactive session (i.e. remoting in and watching what you're doing)

Improve this answer
1
  • Thanks for the info.! I suppose this means he's probably mapping a drive to one of the admin shares (e.g., C$ or ADMIN$), right? (because I don't have any other shared folders except the standard admin shares)
    – lmttag
    May 14, 2019 at 18:33

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .