deepblue/windows-itpro-docs
1
0
Fork 0
mirror of https://github.com/MicrosoftDocs/windows-itpro-docs.git synced 2025-06-27 16:23:36 +00:00
Code Issues Actions 3 Packages Projects Releases Wiki Activity

Merge pull request #9490 from MicrosoftDocs/main

Browse Source 
Publish main to live, Wednesday 10:30AM PST, 01/24
This commit is contained in:
Stacyrch140
2024-01-24 13:40:02 -05:00
committed by GitHub
parent 3012b170ff 32e5264742
commit c39aaf7c36
1 changed files with 3 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
windows/security/threat-protection/auditing/event-4624.md
View File

@ -251,6 +251,9 @@ This event generates when a logon session is created (on destination machine). I
- 0 for interactive logons. - 0 for interactive logons.
> [!NOTE]
The fields for IP address/port and workstation name are populated depending on the authentication context and protocol used. LSASS will audit the information the authenticating service shares with LSASS. For example, network logons with Kerberos likely have no workstation information, and NTLM logons have no TCP/IP details.
**Detailed Authentication Information:** **Detailed Authentication Information:**
- **Logon Process** [Type = UnicodeString]**:** the name of the trusted logon process that was used for the logon. See event "[4611](event-4611.md): A trusted logon process has been registered with the Local Security Authority" description for more information. - **Logon Process** [Type = UnicodeString]**:** the name of the trusted logon process that was used for the logon. See event "[4611](event-4611.md): A trusted logon process has been registered with the Local Security Authority" description for more information.