Event ID: 4648

A logon was attempted using explicit credentials

A logon was attempted using explicit credentials.

Subject:
    Security ID:        %1
    Account Name:       %2
    Account Domain:     %3
    Logon ID:           %4
    Logon GUID:         %5

Account Whose Credentials Were Used:
    Account Name:       %6
    Account Domain:     %7
    Logon GUID:         %8

Target Server:
    Target Server Name:     %9
    Additional Information: %10

Process Information:
    Process ID:         %11
    Process Name:       %12

Network Information:
    Network Address:    %13
    Port:               %14

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
Microsoft Documentation

Event ID - 4648



This event is generated when a process attempts an account logon by explicitly specifying that account’s credentials.

This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the “RUNAS” command.

It is also a routine event which periodically occurs during normal operating system activity.



Name Field Insertion String OS Example
Security ID SubjectUserSid %1 Any S-1-5-21-3457937927-2839227994-823803824-1104
Account Name SubjectUserName %2 Any UserName
Account Domain SubjectDomainName %3 Any DOMAIN
Logon ID SubjectLogonId %4 Any 0x31844
Logon GUID LogonGuid %5 Any {00000000-0000-0000-0000-000000000000}
Account Name TargetUserName %6 Any UserName
Account Domain TargetDomainName %7 Any DOMAIN
Logon GUID TargetLogonGuid %8 Any {0887F1E4-39EA-D53C-804F-31D568A06274}
Target Server Name TargetServerName %9 Any localhost
Additional Information TargetInfo %10 Any localhost
Process ID ProcessId %11 Any 0x368
Process Name ProcessName %12 Any C:\Windows\System32\svchost.exe
Network Address IpAddress %13 Any 127.0.0.1
Port IpPort %14 Any 0


Lookup Audit Policy Configuration Settings

C:\> AuditPol.exe /get /subcategory:Logon
How to enable Windows Auditing



LEFT/RIGHT arrow keys for navigation

Back to List