如何从 4624 事件日志数据中过滤掉用户键盘登录时间？

Question

看来我的过滤方法只是部分正确，因为并非每个键盘登录都会在事件查看器中显示为类型 2 的事件 4624。下面是登录类型及其说明的表格，表格来源于终极Windows安全。

Logon                       Description
Type     
-----------------------------------------------------------------------------------------------------
2    Interactive (logon at keyboard and screen of system)
3    Network (i.e. connection to shared folder on this computer from elsewhere on network)
4    Batch (i.e. scheduled task)
5    Service (Service startup)
7    Unlock (i.e. unnattended workstation with password protected screen saver)
8    NetworkCleartext (Logon with credentials sent in the clear text. Most often indicates 
     a logon to IIS with "basic authentication") 
9    NewCredentials such as with RunAs or mapping a network drive with alternate credentials.  
     This logon type does not seem to show up in any events.  If you want to track users attempting 
     to logon with alternate credentials see 4648.  MS says "A caller cloned its  current token and 
     specified new credentials for outbound connections. The new logon session has  the same local 
     identity, but uses different credentials for other network connections."
10   RemoteInteractive (Terminal Services, Remote Desktop or Remote Assistance)
11   CachedInteractive (logon with cached domain credentials such as 
     when logging on to a laptop when away from the network)

交互式登录的确切定义对我来说仍然有点模糊，因为我发现有相互矛盾的定义，但类型 10 和 11 的描述中都有交互式。当我在未连接到网络的情况下登录我的工作站时，就会发生类型 11。

将该事件和类型添加到过滤器使我能够找出所有登录事件。

Answer 1

看来我的过滤方法只是部分正确，因为并非每个键盘登录都会在事件查看器中显示为类型 2 的事件 4624。下面是登录类型及其说明的表格，表格来源于终极Windows安全。

Logon                       Description
Type     
-----------------------------------------------------------------------------------------------------
2    Interactive (logon at keyboard and screen of system)
3    Network (i.e. connection to shared folder on this computer from elsewhere on network)
4    Batch (i.e. scheduled task)
5    Service (Service startup)
7    Unlock (i.e. unnattended workstation with password protected screen saver)
8    NetworkCleartext (Logon with credentials sent in the clear text. Most often indicates 
     a logon to IIS with "basic authentication") 
9    NewCredentials such as with RunAs or mapping a network drive with alternate credentials.  
     This logon type does not seem to show up in any events.  If you want to track users attempting 
     to logon with alternate credentials see 4648.  MS says "A caller cloned its  current token and 
     specified new credentials for outbound connections. The new logon session has  the same local 
     identity, but uses different credentials for other network connections."
10   RemoteInteractive (Terminal Services, Remote Desktop or Remote Assistance)
11   CachedInteractive (logon with cached domain credentials such as 
     when logging on to a laptop when away from the network)

交互式登录的确切定义对我来说仍然有点模糊，因为我发现有相互矛盾的定义，但类型 10 和 11 的描述中都有交互式。当我在未连接到网络的情况下登录我的工作站时，就会发生类型 11。

将该事件和类型添加到过滤器使我能够找出所有登录事件。

如何从 4624 事件日志数据中过滤掉用户键盘登录时间？

答案1

相关内容