thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Security Operations · Intermediate

Event ID 4624

The Windows Security event recorded when an account successfully logs on.

Definition

Event 4624 includes the logon type, such as 2 interactive, 3 network, 4 batch, 5 service, 7 unlock, 10 RemoteInteractive (RDP) and 11 cached interactive, along with source IP and authentication package. Analysts use it to trace lateral movement and unusual access.

Example

A 4624 with logon type 10 from an unfamiliar IP to a server indicates an RDP login.

Exam tip

Logon type 3 = network (SMB/PsExec), type 10 = RDP; both appear in lateral movement questions.

Related terms