Account login tracking
If you want to profile specific account behavior or track compromised account activities, Microsoft gives you the ability to track every login attempt that either succeeded or failed by recording event logs for each login attempt. These events include valuable information, such as attempt time, account name, authentication method, and so on. All the authentication logs are logged in the Security log file.
To explain the account login tracking logs, we will divide this section into five subsections:
- Windows accounts
- Tracking successful logins
- Tracking successful administrator logins
- Tracking logon sessions
- Tracking failed logins
Let’s take a look.
Windows accounts
Before digging into the Windows event logs, first, you need to understand that in the Windows environment, every Windows process or activity such as authentication, object access, or running services must be associated with an account. This account could...
