Event ID 4624 records a successful logon in the Windows Security log. It is generated on the destination computer when a logon session is created. Defenders correlate Logon Type, TargetUserName, IpAddress, and AuthenticationPackageName to spot interactive use, remote access, service activity, and suspicious source addresses.
What Event ID 4624 Represents in Windows Security Logging
Event ID 4624 is the Windows Security log record for a successful logon. It is created on the destination system when a logon session is established, which makes it one of the most important audit signals for understanding who accessed a host and how.
The event is valuable because it marks an access boundary crossing rather than just an authentication attempt. In practice, the surrounding fields, especially Logon Type and AuthenticationPackageName, help distinguish console use, remote administration, scheduled task activity, service starts, network logons, and other ways a session can be created.
How Defenders Interpret the Fields
Event ID 4624 becomes far more useful when it is read as a structured record rather than a single success indicator. TargetUserName identifies the account involved, while IpAddress can reveal the source of remote activity or highlight unexpected origin points for a session.
Logon Type is often the fastest way to separate normal from suspicious behaviour. For example, a service account with a service logon pattern looks very different from an interactive administrator session, and the context changes again when a remote logon originates from an unusual system or subnet.
AuthenticationPackageName also adds important context because it shows which Windows authentication path was used. That helps analysts correlate the logon with expected enterprise mechanisms, and it supports investigations when the same account appears under different logon patterns across a short time window.
Why Event ID 4624 Matters for Detection
Successful logon events are central to detection because adversaries often need a valid session before they can move, enumerate, or persist. A 4624 record can support the timeline for interactive compromise, remote administration abuse, service-account misuse, or access from an unexpected network location.
It is also a key pivot for correlation. Defenders frequently compare 4624 with failed logons, process creation, privilege assignment, task creation, and logon/logoff sequences to determine whether the event reflects routine activity or the start of a broader incident.
For Windows-centric monitoring, pairing this event with broader host telemetry improves confidence. Windows Event Log Guide is useful background when teams want to place 4624 alongside adjacent event IDs, audit policy, and log collection practices.
Operational Context and Common Use Cases
Event ID 4624 is most useful when teams already know what “normal” looks like for their environment. Baselines for logon type, account, host role, time of day, and source address patterns make the event much easier to interpret than isolated single-event reviews.
On servers, repeated 4624 activity can reflect expected service behaviour, scheduled maintenance, or administrative access. On workstations, the same event may indicate direct user interaction, remote support, or, when combined with other anomalies, an initial foothold being used for follow-on activity.
When the event is part of a larger Windows telemetry strategy, it benefits from complementary host controls and log sources. Sysmon Guide helps connect logon activity to process creation, network connections, and tamper-aware detection workflows, while Kerberos Security Guide adds context for authentication paths that often surface in 4624 analysis.
Risk and Threat Considerations
Successful logons are not inherently suspicious, but they are a high-value indicator because they confirm that an account, token, or authentication flow produced a usable session. That makes Event ID 4624 a common starting point for investigating unauthorized access, lateral movement, and misuse of legitimate credentials.
Failure mechanism: Attackers who obtain valid credentials, tokens, or remote access paths can generate normal-looking successful logons that blend into routine administrator or service activity, especially when the source host and logon type are expected in the environment.
Impact: A compromised or abused logon can create immediate access for reconnaissance, privilege escalation, data access, persistence, or further movement, so post-logon correlation is often as important as the event itself.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1078 — Valid Accounts | Successful logons often reflect use of valid credentials to gain access. |
| Recommendation — Hunt for valid-account abuse when 4624 appears with unusual source, logon type, or timing. | ||
| NIST SP 800-53 Rev 5 | AU-12 — Audit Record Generation | 4624 is a generated audit record that supports security monitoring and investigation. |
| AU-6 — Audit Review, Analysis, and Reporting | Defenders must analyze 4624 in context to distinguish normal from suspicious access. | |
| Recommendation — Configure audit generation so successful logons are consistently recorded and retained. Correlate 4624 with related host and account events to surface anomalous access. | ||
| CIS Controls v8 | CIS-8 — Audit Log Management | Windows successful logons are core audit-log material for detection and response. |
| Recommendation — Centralize and review logon telemetry so successful access events are searchable and retained. | ||
Practitioner Guidance
Why practitioners should care: Event ID 4624 is one of the most practical Windows audit records for confirming that access really happened, but it only becomes actionable when defenders interpret it in context. Teams should treat it as a correlation anchor, not as proof of legitimate use.
What to watch for: Pay attention to unusual source addresses, unexpected logon types for a given account, successful logons outside normal hours, and account activity that does not match the host role. The strongest investigations usually start when the event deviates from an established baseline, not when it appears in isolation.
Practitioner takeaway: The best use of 4624 is to combine it with account, host, and network context so that successful access is judged by pattern, not by the event alone.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 18, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org