User Logon

Windows 10 Professional

A users log in will likely be the first sign of an attack and can indicate suspicious behavior. It can also give an analyst a starting time to create a timeline of events. This log is recquired in the HIPAA and PCI DSS regulations and is recommended by the NSA Event Forwarding Guidance and JPCERT.
Powershell
wevtutil qe Security "/q:*[System [(EventID=4624)]]" /f:text /c:1
Add to Sawmill
View Sawmill Selection

Windows 10 Professional does not log this by default. To enable logging of this activity, launch the Group Policy Editor. From here, expand the Windows settings folder and open the Security Settings tab. Finally, expand the Local Policies tab and click to enter the Audit Policy header.

group policy editor image

In order to turn on login auditing, double click "Audit login events". Clicking the Success box will allow for the auditing of all successful login attempts.

gpe setting image

Windows 10 Home does not require login auditing be turned on and is done by default. To view this log in the Event Viewer, open the event viewer and navigate to the Windows Logs heading and then the Security Tab. From here, select the find function and search for the value 4624 , or filter the log for the ID 4624.

WEV image

To view this log in the command line (via powershell or command prompt, enter the commandwevtutil qe Security "/q:*[System [(EventID=4624)]]"This will show all instances of the event ID 4624 , which is the login log ID.

Command Line Image
Powershell
wevtutil qe Security "/q:*[System [(EventID=4624)]]" /f:text /c:1
Add to Sawmill
View Sawmill Selection