如何從 4624 事件日誌資料中過濾掉僅使用者鍵盤登入時間？

Question

看來我的過濾方法只是部分正確，因為並非每個鍵盤登入都會在事件檢視器中顯示為類型 2 的事件 4624。終極Windows安全。

Logon                       Description
Type     
-----------------------------------------------------------------------------------------------------
2    Interactive (logon at keyboard and screen of system)
3    Network (i.e. connection to shared folder on this computer from elsewhere on network)
4    Batch (i.e. scheduled task)
5    Service (Service startup)
7    Unlock (i.e. unnattended workstation with password protected screen saver)
8    NetworkCleartext (Logon with credentials sent in the clear text. Most often indicates 
     a logon to IIS with "basic authentication") 
9    NewCredentials such as with RunAs or mapping a network drive with alternate credentials.  
     This logon type does not seem to show up in any events.  If you want to track users attempting 
     to logon with alternate credentials see 4648.  MS says "A caller cloned its  current token and 
     specified new credentials for outbound connections. The new logon session has  the same local 
     identity, but uses different credentials for other network connections."
10   RemoteInteractive (Terminal Services, Remote Desktop or Remote Assistance)
11   CachedInteractive (logon with cached domain credentials such as 
     when logging on to a laptop when away from the network)

互動式登入的確切定義對我來說仍然有點模糊，因為我發現定義相互衝突，但類型 10 和 11 在其描述中包含「互動式」。當我在未連接到網路的情況下登入工作站時，會發生類型 11。

將該事件和類型新增至篩選器使我能夠找出所有登入事件。

Answer 1

看來我的過濾方法只是部分正確，因為並非每個鍵盤登入都會在事件檢視器中顯示為類型 2 的事件 4624。終極Windows安全。

Logon                       Description
Type     
-----------------------------------------------------------------------------------------------------
2    Interactive (logon at keyboard and screen of system)
3    Network (i.e. connection to shared folder on this computer from elsewhere on network)
4    Batch (i.e. scheduled task)
5    Service (Service startup)
7    Unlock (i.e. unnattended workstation with password protected screen saver)
8    NetworkCleartext (Logon with credentials sent in the clear text. Most often indicates 
     a logon to IIS with "basic authentication") 
9    NewCredentials such as with RunAs or mapping a network drive with alternate credentials.  
     This logon type does not seem to show up in any events.  If you want to track users attempting 
     to logon with alternate credentials see 4648.  MS says "A caller cloned its  current token and 
     specified new credentials for outbound connections. The new logon session has  the same local 
     identity, but uses different credentials for other network connections."
10   RemoteInteractive (Terminal Services, Remote Desktop or Remote Assistance)
11   CachedInteractive (logon with cached domain credentials such as 
     when logging on to a laptop when away from the network)

互動式登入的確切定義對我來說仍然有點模糊，因為我發現定義相互衝突，但類型 10 和 11 在其描述中包含「互動式」。當我在未連接到網路的情況下登入工作站時，會發生類型 11。

將該事件和類型新增至篩選器使我能夠找出所有登入事件。

如何從 4624 事件日誌資料中過濾掉僅使用者鍵盤登入時間？

答案1

相關內容