Event ID 4624 — Successful opening of the session

A session opening was accepted by Windows.

Source of event

Microsoft-Windows-Security-Auditing — Security category.

Possible causes

• Normal connection of a user
• Authentication of a service or task
• Network connection to a sharing
• RDP session according to Logon Type

Verifications to be carried out

1. Control Logon Type field
2. Identify Account Name and Postation Name
3. Compare Source Network Address with the expected context

Useful orders….

Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4624} -MaxEvents 20

To be retained….

An Event ID must always be interpreted with its source, its full message, its timing and the context of the system. The same number may exist in several providers of events.