Review Login Events on a Windows Server

Step 1: Turn on logon auditing

1. Open the Local Group Policy Editor. Type gpedit.msc in the search box and press Enter.
2. Go to Computer Configuration, Windows Settings, Security Settings, Local Policies, Audit Policy.
3. Double-click Audit logon events.
4. Tick Success and Failure and click OK.
5. Close the editor.

(On newer servers you can use Advanced Audit Policy Configuration, then Logon/Logoff, then Audit Logon.)

Step 2: Open Event Viewer

1. Click the Start menu and type Event Viewer.
2. Click Event Viewer in the results.
3. Expand Windows Logs.
4. Click Security.

Step 3: Filter the logon events

1. In the Security log, click Filter Current Log in the Actions pane on the right.
2. In the dialog, choose Microsoft Windows security auditing as the event source (in some versions, open Event sources).
3. Tick Audit Success and Audit Failure under Keywords.
4. In User, type a name to see the events of one user.
5. Click OK.

Only successful logons

1. Open the Security log and click Filter Current Log.
2. Choose Microsoft Windows security auditing as the source.
3. Tick Audit Success in Keywords.
4. Type 4624 in Event IDs.
5. Type the user name in User if you want one user.
6. Click OK.

Useful event IDs

Look at the Logon Type inside an event: type 2 is local, type 3 is network, and type 10 is Remote Desktop.

Use PowerShell

To list the last 20 failed logons:

Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625} -MaxEvents 20

What to look for

• Many failed logons (4625) in a short time, which can mean a brute-force attack.
• Logons at odd hours.
• Logons from unknown IP addresses (shown in the event details).

Quick recap

• Turn on Audit logon events (success and failure).
• Filter the Security log in Event Viewer for 4624 and 4625.
• Watch for many failed logons.