1. Mastering Windows Network Forensics and Investigation Chapter 13: Logon and Account Logon Events

2. Chapter Topics: Logon vs. Account Logon Events Authentication in a Domain Environment Logging within a Domain Environment

3. Logon vs. Account Logon Logon Events –Event ID 5xx (Windows XP) –Event ID 46xx (Windows Vista +) –Log Access to a resource Account Logon Event –Event ID 6xx (Windows XP) –Event ID 47xx (Windows Vista +) –Log Authentication of credentials

4. Common Windows XP Logon Events 528 – Local logon 540 – Network Logon 538 – Logoff 529 – Failed Logon

5. Common Windows Vista + Logon Events 4624 – Local logon 4624 – Network Logon 4634 – Logoff 4625 – Failed Logon

6. Common Logon Events (WinXP)

8. Common Logon Events (Win Vista +)

10. Authentication Domain accounts are authenticated by DCs Local Accounts authenticated by local computer’s SAM Kerberos is default authentication method in a domain NTLM is default authentication method for local accounts

11. Kerberos Domain Authentication Key Distribution Center (Domain Controller) Client 1. Authentication request based on username and password 2. KDC issues a TGT to client 3. Client presents TGT to KDC with request to access client computer 4. KDC issues service ticket to client valid for file server 5. Based on the properly issued service ticket, the client computer grants the logon request

12. Common Account Logon Events (Win XP) 672 – TGT issued 673 – Service Ticket issued 675 – Failed Kerberos Authentication 680 – NTLM authentication event

13. Common Account Logon Events (Win Vista +) 4768 – TGT issued 4769 – Service Ticket issued 4771 – Failed Kerberos Pre- Authentication 4776 – NTLM authentication event

14. Common Account Logon Events

20. Domain Logging of a Client being used to Access a File Server 672 673 (Client) 673 (DC) 673 (krbtgt) 540 538 673 (File Server) 4768 4769 (Client) 4769 (DC) 4769 (krbtgt) 4624 4634 4769 (File Server) Domain Controller 4624 528 4624 4634 540 538 Client Computer File Server Vista +Win XP Vista +Win XP Vista +Win XP