> For the complete documentation index, see [llms.txt](https://windows.dfirhandbook.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://windows.dfirhandbook.com/windows-artifacts/account-usage/authentications-windows-event-log.md).

# Authentications (Windows Event Log)

## Key Points

* **Purpose**: Analyzing Windows Event Logs for authentication events to detect unauthorized access.
* **Primary Event IDs**: 4624, 4634, 4672, 4732, 4648, 4688, 4697, 4768.
* **Significance**: These events indicate various authentication-related activities, crucial for security monitoring.

## Considerations

* **Event Log Integrity**: Ensure the integrity of event logs to maintain the reliability of the analysis.
* **Contextual Analysis**: Analyze events within the context of other system activities for accurate interpretation.
* **Regular Monitoring**: Continuously monitor event logs to promptly detect and respond to security incidents.

## Detailed Explanation

### Windows Event Logs: An Overview

Windows Event Logs provide a record of security, system, and application events. Analyzing these logs is critical for identifying potential security incidents and unauthorized access attempts.

### Monitoring Authentication Events

Specific Windows Event IDs are crucial for monitoring authentication-related activities:

#### Key Event IDs

1. [**4624** ](https://app.gitbook.com/o/2sihAyERJmSXHn3m7cvC/s/EcAeOZhLg6uTRTQSwAxM/~/changes/25/windows-artifacts/event-ids/authentication-account/4624-authentication-success)**(Successful Login)**
2. [**4634** ](https://app.gitbook.com/o/2sihAyERJmSXHn3m7cvC/s/EcAeOZhLg6uTRTQSwAxM/~/changes/25/windows-artifacts/event-ids/authentication-account/4634-account-logoff)**(Logout)**
3. [**4672** ](https://app.gitbook.com/o/2sihAyERJmSXHn3m7cvC/s/EcAeOZhLg6uTRTQSwAxM/~/changes/25/windows-artifacts/event-ids/authentication-account/4672-special-privileges)**(Special Privileges Assigned)**
4. [**4732** ](https://app.gitbook.com/o/2sihAyERJmSXHn3m7cvC/s/EcAeOZhLg6uTRTQSwAxM/~/changes/25/windows-artifacts/event-ids/authentication-account/4732-addition-to-local-group)**(Addition to Local Group)**
5. [**4648** ](https://app.gitbook.com/o/2sihAyERJmSXHn3m7cvC/s/EcAeOZhLg6uTRTQSwAxM/~/changes/25/windows-artifacts/event-ids/authentication-account/4648-explicit-credentials-success)**(Login with Explicit Credentials)**
6. [**4688** ](https://app.gitbook.com/o/2sihAyERJmSXHn3m7cvC/s/EcAeOZhLg6uTRTQSwAxM/~/changes/25/windows-artifacts/event-ids/file-system/4688-process-created)**(New Process Creation)**
7. **4697 (Service Installation)**
8. **4768 (Kerberos TGT Request)**

#### Analyzing Event Logs

* **Tool Usage**: Use tools like Windows Event Viewer or third-party applications for log analysis.
* **Pattern Recognition**: Look for patterns and anomalies in event log entries.
* **Correlation with Other Data**: Cross-reference with other system logs for comprehensive analysis.

### Case Study: Detecting Forged Kerberos Tickets

Sean Metcalf's article on detecting forged Kerberos tickets provides valuable insights into advanced authentication attack techniques. It can be found at [ADSecurity](https://adsecurity.org/?p=1515). This case study emphasizes the importance of understanding sophisticated attack vectors in Windows environments.