Chapter 13: Logon and Account Logon Events
20
Mastering Windows Network Forensics and Investigation Chapter 13: Logon and Account Logon Events
description
Chapter 13: Logon and Account Logon Events. Mastering Windows Network Forensics and Investigation. Chapter Topics:. Logon vs. Account Logon Events Authentication in a Domain Environment Logging within a Domain Environment. Logon vs. Account Logon. Logon Events Event ID 5xx (Windows XP) - PowerPoint PPT Presentation
Transcript of Chapter 13: Logon and Account Logon Events
Mastering Windows Network Forensics and Investigation
Chapter 13: Logon and Account Logon Events
Chapter Topics:
• Logon vs. Account Logon Events
• Authentication in a Domain Environment
• Logging within a Domain Environment
Logon vs. Account Logon
• Logon Events– Event ID 5xx (Windows XP)– Event ID 46xx (Windows Vista +)– Log Access to a resource
• Account Logon Event– Event ID 6xx (Windows XP)– Event ID 47xx (Windows Vista +)– Log Authentication of credentials
Common Windows XP Logon Events
• 528 – Local logon
• 540 – Network Logon
• 538 – Logoff
• 529 – Failed Logon
Common Windows Vista +Logon Events
• 4624 – Local logon
• 4624 – Network Logon
• 4634 – Logoff
• 4625 – Failed Logon
Common Logon Events (WinXP)
Common Logon Events (WinXP)
Common Logon Events (Win Vista +)
Common Logon Events(Win Vista +)
Authentication
• Domain accounts are authenticated by DCs
• Local Accounts authenticated by local computer’s SAM
• Kerberos is default authentication method in a domain
• NTLM is default authentication method for local accounts
Kerberos Domain Authentication
Key Distribution
Center (Domain
Controller)
Client
1. Authenticatio
n request b
ased on username and password
2. KDC issues a TGT to
client
3. Client p
resents TGT to KDC with
request to
access client computer
4. KDC issues service tic
ket to client valid fo
r file server
5. Based on the properly issued service ticket, the client computer grants the logon request
Common Account Logon Events (Win XP)
• 672 – TGT issued
• 673 – Service Ticket issued
• 675 – Failed Kerberos Authentication
• 680 – NTLM authentication event
Common Account Logon Events(Win Vista +)
• 4768 – TGT issued
• 4769 – Service Ticket issued
• 4771 – Failed Kerberos Pre-Authentication
• 4776 – NTLM authentication event
Common Account Logon Events
Common Account Logon Events
Common Account Logon Events
Common Account Logon Events
Common Account Logon Events
Common Account Logon Events
Domain Logging of a Client being used to Access a File Server
• 672
• 673 (Client)
• 673 (DC)
• 673 (krbtgt)
• 540
• 538
• 673 (File Server)
• 4768
• 4769 (Client)
• 4769 (DC)
• 4769 (krbtgt)
• 4624
• 4634
• 4769 (File Server)
Domain Controller
• 4624 • 528
• 4624
• 4634
• 540
• 538
Client Computer
File Server
Vista + Win XP
Vista + Win XP
Vista + Win XP
