Monitoring Windows Event IDs: Unsuccessful Logins, Unlocks, and Startups in Windows 11
Windows event logs are a valuable resource for monitoring system activity and identifying potential security threats. In this article, we will focus on three specific event IDs related to user activity in Windows 11: unsuccessful logins, unlocks, and startups.
Unsuccessful Logins
Unsuccessful login attempts can indicate a potential security threat, such as a brute force attack or an unauthorized user trying to access the system. In Windows 11, unsuccessful login attempts are recorded in the event log with event ID 4625.
Event ID: 4625
Task Category: Logon
Level: Information
Keywords: Audit Failure
Description: An account failed to log on.The event log entry for a failed login attempt will include information such as the account name, workstation name, and the reason for the failure. This information can be used to identify and address potential security threats.
Unlocks
Unlock events are recorded in the event log when a user unlocks the workstation after it has been locked. In Windows 11, unlock events are recorded with event ID 4800.
Event ID: 4800
Task Category: Workstation Lock/Unlock
Level: Information
Keywords: Audit Success
Description: A workstation was unlocked.Tracking unlock events can be useful for identifying patterns of user activity and detecting potential security threats. For example, if a user's account is being used to unlock the workstation at unusual times or from unusual locations, it could indicate a security breach.
Startups
Startup events are recorded in the event log when a user logs on and the system starts various services and processes. In Windows 11, startup events are recorded with event ID 7000.
Event ID: 7000
Task Category: None
Level: Information
Keywords: Audit Success
Description: The last good boot time was saved for the operating system.Tracking startup events can be useful for identifying potential performance issues and ensuring that necessary services and processes are starting correctly. It can also be used to detect potential security threats, such as malware that starts up automatically when the system is booted.
Monitoring Windows event logs is an important aspect of system administration and security. By tracking event IDs related to unsuccessful logins, unlocks, and startups, you can identify potential security threats and address them in a timely manner. In addition, tracking these events can help you identify patterns of user activity and detect potential performance issues.
References
- Microsoft Docs: Event ID 4625
- Microsoft Docs: Event ID 4800
- Microsoft Docs: Event ID 7000