Existe um registro de contas mostrando as conexões feitas ao meu computador?
Um evento " 4624: Uma conta com sessão iniciada com êxito " é adicionado ao Registo de Eventos do Sistema.
O Tipo de Logon será 3 - Rede (ou seja, conexão com a pasta compartilhada neste computador de outro lugar na rede).
O endereço de rede de origem será o endereço IP do computador em que o usuário está fisicamente presente na maioria dos casos.
4624: Uma conta foi registrada com sucesso
Identifies the account that requested the logon - NOT the user who just logged on. Subject is usually Null or one of the Service principals and not usually useful information. See New Logon (later in this answer) for who just logged on to the sytem.
- Security ID
- Account Name
- Account Domain
- Logon ID
Logon Information:
- Logon Type: See below
Remaining logon information fields are new to Windows 10/2016
- Restricted Admin Mode: Normally "-"."Yes" for incoming Remote Desktop Connections where the client specified /restrictedAdmin
- Virtual Account: Normally "No". This will be Yes in the case of services configured to logon with a "Virtual Account".
- Elevated Token: This has something to do with User Account Control but our research so far has not yielded consistent results.
Logon Type:
This is a valuable piece of information as it tells you HOW the user just logged on:
New Logon:
The user who just logged on is identified by the Account Name and Account Domain. You can determine whether the account is local or domain by comparing the Account Domain to the computer name. If they match, the account is a local account on that system, otherwise a domain account.
- Security ID: the SID of the account
- Account Name: Logon name of the account
- Account Domain: Domain name of the account (pre-Win2k domain name)
- Logon ID: a semi-unique (unique between reboots) number that identifies the logon session just initiated. Any events logged subsequently during this logon session will report the same Logon ID through to the logoff event 4647 or 4634.
- Logon GUID: Supposedly you should be able to correlate logon events on this computer with corresonding authentication events on the domain controller using this GUID. Such as linking 4624 on the member computer to 4769 on the DC. But the GUIDs do not match between logon events on member computers and the authentication events on the domain controller.
Process Information:
- Process ID is the process ID specified when the executable started as logged in 4688.
- Process Name: identifies the program executable that processed the logon. This is one of the trusted logon processes identified by 4611.
Network Information:
This section identifies WHERE the user was when he logged on. Of course if logon is initiated from the same computer this information will either be blank or reflect the same local computers.
- Workstation Name: the computer name of the computer where the user is physically present in most cases unless this logon was intitiated by a server application acting on behalf of the user. Workstation may also not be filled in for some Kerberos logons since the Kerberos protocol doesn't really care about the computer account in the case of user logons and therefore lacks any field for carrying workstation name in the ticket request message.
- Source Network Address: the IP address of the computer where the user is physically present in most cases unless this logon was intitiated by a server application acting on behalf of the user. If this logon is initiated locally the IP address will sometimes be 127.0.0.1 instead of the local computer's actual IP address. This field is also blank sometimes because Microsoft says "Not every code path in Windows Server 2003 is instrumented for IP address, so it's not always filled out."
- Source Port: identifies the source TCP port of the logon request which seems useless since with most protocols source ports are random.
Fonte 4624: uma conta foi registrada com sucesso