Merge pull request #11865 from HerbertMauerer/patch-14

Update event-4624.md
This commit is contained in:
Aaron Czechowski 2024-01-24 06:57:12 -08:00 committed by GitHub
commit 32e5264742
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194

View File

@ -251,6 +251,9 @@ This event generates when a logon session is created (on destination machine). I
- 0 for interactive logons. - 0 for interactive logons.
> [!NOTE]
The fields for IP address/port and workstation name are populated depending on the authentication context and protocol used. LSASS will audit the information the authenticating service shares with LSASS. For example, network logons with Kerberos likely have no workstation information, and NTLM logons have no TCP/IP details.
**Detailed Authentication Information:** **Detailed Authentication Information:**
- **Logon Process** [Type = UnicodeString]**:** the name of the trusted logon process that was used for the logon. See event "[4611](event-4611.md): A trusted logon process has been registered with the Local Security Authority" description for more information. - **Logon Process** [Type = UnicodeString]**:** the name of the trusted logon process that was used for the logon. See event "[4611](event-4611.md): A trusted logon process has been registered with the Local Security Authority" description for more information.