Reading the Security Log¶
Once auditing is on, the Security log answers the questions forensics asks: who logged in, when, from where, and what did they change.
Event IDs to know¶
| ID | Meaning |
|---|---|
| 4624 | Successful logon. Look at Logon Type: 2 is at the console, 3 is over the network (shares), 10 is Remote Desktop, 5 is a service starting. |
| 4625 | Failed logon. Many in a row from one source is a password attack. |
| 4634 / 4647 | Logoff |
| 4672 | Special privileges assigned at logon (an administrator logged in) |
| 4720 | User account created |
| 4722 | User account enabled |
| 4725 | User account disabled |
| 4726 | User account deleted |
| 4724 | Password reset by an administrator |
| 4723 | Password changed by the user |
| 4732 | Member added to a local group (4728 for a global group, 4756 universal) |
| 4733 | Member removed from a local group |
| 4740 | Account locked out |
| 4719 | Audit policy changed |
| 4688 | A process was created. With command-line logging on, the Message shows the full command. |
| 4688 | A process was created. With command-line logging on, the Message shows the full command. |
| 4697 | A service was installed |
| 4698 | A scheduled task was created |
| 1102 | The audit log was cleared. Always suspicious. |
In Event Viewer¶
eventvwr.msc → Windows Logs → Security → Filter Current Log (right side) → type the event ID in the Event IDs box → OK.
Double-click an event to read it. The General tab has the human-readable version; the Details tab has every field.
With PowerShell¶
Last 20 failed logons:
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625} -MaxEvents 20 | Format-List TimeCreated, Message
Every account created:
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4720} | Select TimeCreated, @{n='Account';e={$_.Properties[0].Value}}, @{n='By';e={$_.Properties[4].Value}}
Logons by one user:
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4624} | Where { $_.Properties[5].Value -eq 'bob' } | Select TimeCreated, @{n='Type';e={$_.Properties[8].Value}}
Events in a time window:
Get-WinEvent -FilterHashtable @{LogName='Security'; StartTime='2026-09-01 22:00'; EndTime='2026-09-02 02:00'} | Select TimeCreated, Id, Message
Answering forensics questions¶
Typical questions and where the answer is:
| Question | Look at |
|---|---|
| Who logged in last night? | 4624 events in that time window, Logon Type 2 or 10 |
When was the account hacker created, and by whom? |
4720; the "Subject" fields name who did it |
| Which account was added to Administrators? | 4732 |
| Has anyone cleared the log? | 1102 |
| What service was installed on a date? | 4697 in the Security log, or 7045 in the System log |
If the log is empty for the period you're asked about, auditing was off then. Say so; don't guess.
Example¶
The forensics question asks which user account was added to the Administrators group and when. Filter for 4732. One event: Member: CORP\hacker, Group: Administrators, Subject: bob, 9/1/2026 11:47 PM. That's the answer, and it also tells you bob's account was being used by an attacker at that time.