Where's the 4624? - Logon Events vs. Account Logons

In this episode, we'll learn about the difference between "Logon Events" and "Account Logons" and explore a scenario in which communication occurs between two domain-joined workstations. Where will we find Event ID 4624 and other account-related Event IDs of interest?

** If you enjoy this video, please consider supporting 13Cubed on Patreon at patreon.com/13cubed. **

📖 Chapters

00:00 - Intro
01:18 - Win11-Test-VM
02:14 - Win10-Test-VM
03:41 - Win2019-Test-VM
05:28 - Recap

🛠 Resources

Logon/Logoff Events:
https://www.ultimatewindowssecurity.c...

Account Logon Events:
https://www.ultimatewindowssecurity.c...

#Forensics #DigitalForensics #DFIR #ComputerForensics #WindowsForensics