| Event Id | 528 |
| Source | Security |
| Description | Successful Logon: User Name: <User Name> Domain: <Domain> Logon ID: <Logon ID> Logon Type: <Logon Type> Logon Process: <Logon Process> Authentication Package:<Authentication Package> Workstation Name: <Workstation Name> Logon GUID: <Logon GUID> Caller User Name: <Caller Domain> Caller Domain: <Caller Domain> Caller Logon ID: <Caller Logon ID> Caller Process ID: <Caller Process ID> Transited Services: <Transited Services> Source Network Address: <Source Network Address> Source Port: <Source Port> |
| Event Information | According to Microsoft: Cause : A logon session was successfully created for the user. The message contains the Logon ID, a number that is generated when a user logs on to a computer. The Logon ID is unique to that logon session until the computer is restarted, at which point the Logon ID may be reused. The Logon ID can be used to correlate a logon message with other messages, such as object access messages. For logons that use Kerberos, the logon GUID can be used to associate a logon event on this computer with an account logon message on an authenticating computer, such as a domain controller. This message includes the user name and the domain information for the user account that logged on, the name of the logon process that logged the user on, the type of authentication credentials that were presented, and a logon GUID (globally unique identifier). This message also includes a logon type code. The logon type code indicates the manner in which the user logged on. The following table explains the logon type code: Resolution : No user action is required. ----------------------------------------------------------------------------------------- Cause: This event is generated when a logon session is created for the user. The event contains the logon ID, a number that is generated when a user logs on to a computer. The logon ID that is assigned to a logon session is unique to that logon session until the computer is restarted, at which point the logon ID may be reused. The logon ID can be used to correlate a logon event with other events, such as object access events Resolution: No user action is required. |
| Reference Links | Event ID 528 from Source Security Alternate Event ID in Vista and Windows Server 2008 is 4624. Tracking Logon and Logoff Activity in Windows 2000 (Article) Tracking User Activities (White Paper) Security Event for Associating Service Account Logon Events Using Basic Authentication to Generate Kerberos Tokens How To Determine from Which Computer a User Logged On SMS: How to Determine Which Logon Server Was Used During Network Logon Operation XADM: How to Log Mailbox Access by Computer Name |
Catch threats immediately
We work side-by-side with you to rapidly detect cyberthreats
and thwart attacks before they cause damage.