Ravi Sir's Cyber Security Cards › Interview Cards
What Windows Event ID indicates a successful logon?
What Windows Event ID indicates a successful logon? Event ID 4624 is a successful Windows logon. For each 4624 you still check the logon type, account, source IP, time, and if it fits the user’s normal pattern. “4624 is a successful logon, but success isn’t automatically safe. I check the context.”
Read card text
What this card says
Short answer
Event ID 4624 is a successful Windows logon.
Example
For each 4624 you still check the logon type, account, source IP, time, and if it fits the user’s normal pattern.
Say it in the interview
“4624 is a successful logon, but success isn’t automatically safe. I check the context.”
Why it matters
An attacker’s successful login also shows as 4624, so the detail decides if it’s bad.
Learn more in the lesson: 47.3 Linux, Logs and Windows Event IDs