| Event Id | 4648 |
| Source | Microsoft-Windows-Security-Auditing |
| Description | A logon was attempted using explicit credentials. Subject: Security ID:<Security ID> Account Name:<Account Name> Account Domain:<Domain Name> Logon ID:<Logon ID> Logon GUID:<Logon GUID> Account Whose Credentials Were Used: Account Name:<Account Name> Account Domain:<Domain Name> Logon GUID:<Logon GUID> Target Server: Target Server Name:<Target Server Name> Additional Information: <Additional Information> Process Information: Process ID: <Process ID> Process Name:<Process Name> Network Information: Network Address:<Network Address> Port:<Port> |
| Event Information | Cause : This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. |
| Reference Links |
Catch threats immediately
We work side-by-side with you to rapidly detect cyberthreats
and thwart attacks before they cause damage.