deepblue/windows-itpro-docs
1
0
Fork 0
mirror of https://github.com/MicrosoftDocs/windows-itpro-docs.git synced 2025-06-17 19:33:37 +00:00
Code Issues Actions 3 Packages Projects Releases Wiki Activity

Update event-4624.md

Browse Source
This commit is contained in:
Arjun S
2018-06-28 15:58:02 +05:30
committed by GitHub
parent afb8314a0a
commit ac9e4b7ad1
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
windows/security/threat-protection/auditing/event-4624.md
View File

@ -214,7 +214,7 @@ This event generates when a logon session is created (on destination machine). I
**Process Information:** **Process Information:**
- **Caller Process ID** \[Type = Pointer\]: hexadecimal Process ID of the process that attempted the logon. Process ID (PID) is a number used by the operating system to uniquely identify an active process. To see the PID for a specific process you can, for example, use Task Manager (Details tab, PID column): - **Process ID** \[Type = Pointer\]: hexadecimal Process ID of the process that attempted the logon. Process ID (PID) is a number used by the operating system to uniquely identify an active process. To see the PID for a specific process you can, for example, use Task Manager (Details tab, PID column):
<img src="images/task-manager.png" alt="Task manager illustration" width="585" height="375" /> <img src="images/task-manager.png" alt="Task manager illustration" width="585" height="375" />
@ -222,7 +222,7 @@ This event generates when a logon session is created (on destination machine). I
You can also correlate this process ID with a process ID in other events, for example, “[4688](event-4688.md): A new process has been created” **Process Information\\New Process ID**. You can also correlate this process ID with a process ID in other events, for example, “[4688](event-4688.md): A new process has been created” **Process Information\\New Process ID**.
- **Caller Process Name** \[Type = UnicodeString\]**:** full path and the name of the executable for the process. - **Process Name** \[Type = UnicodeString\]**:** full path and the name of the executable for the process.
**Network Information:** **Network Information:**