- Nationwide Digital Forensic & Cyber Investigation Services
Windows writes an extraordinary amount of evidence about who logged in, from where, with what privileges, and what they ran. It also overwrites that evidence quickly. This page is a practical reference to the event records that decide breach investigations.
| Question | One line answer |
|---|---|
| Which log matters most? | Security, followed by System, PowerShell Operational, and the Terminal Services logs. |
| What proves remote desktop access? | Event 4624 with logon type 10, corroborated by Terminal Services events 1149, 21, 24, and 25. |
| What proves a program ran? | Event 4688 with command line auditing enabled, plus Sysmon Event ID 1 where deployed. |
| What shows the attacker covering tracks? | Event 1102, security log cleared, and gaps in otherwise continuous sequence numbers. |
| How long do logs last? | Until the configured maximum size is reached, which on busy servers can be a matter of hours. |
| Can logs be forged? | Records can be cleared or the service stopped, but selective forgery is difficult and usually leaves detectable inconsistencies. |
| Term | What it means |
|---|---|
| Security log | The Windows audit channel recording logon, privilege, object access, and account management events. |
| Logon type | A numeric field in logon events describing how the session was established, for example interactive, network, or remote interactive. |
| Command line auditing | A policy setting that includes the full command line in process creation events. Without it, event 4688 records only the executable path. |
| Sysmon | A free Microsoft Sysinternals driver that adds detailed process, network, and file telemetry beyond default Windows auditing. |
| Script block logging | PowerShell event 4104, which records deobfuscated script content and is often the only record of a fileless payload. |
| Rollover | Automatic overwriting of the oldest records once a log reaches its maximum configured size. |
A competent Windows analysis does not review every event. It targets a defined set of records that answer specific investigative questions, then expands outward from confirmed hits.
| Event ID | Log | What it means in an intrusion |
|---|---|---|
| 4624 | Security | Successful logon. The logon type and source address identify remote access and lateral movement. |
| 4625 | Security | Failed logon. Volume and pattern distinguish password spraying from a mistyped password. |
| 4648 | Security | Logon using explicit credentials. Frequently seen when stolen credentials are used to pivot. |
| 4672 | Security | Special privileges assigned. Marks an administrative session, usually paired with a 4624. |
| 4688 | Security | Process creation. With command line auditing enabled, this is the closest native equivalent to EDR execution data. |
| 4698 | Security | Scheduled task created. A classic persistence mechanism. |
| 4720 | Security | User account created. Often an attacker establishing a durable foothold. |
| 4769 | Security | Kerberos service ticket requested. Weak encryption requests can indicate Kerberoasting. |
| 4662 | Security | Directory object operation. The replication rights GUID appearing from a non domain controller suggests credential replication abuse. |
| 5140 | Security | Network share accessed. Useful for tracking data staging over server message block. |
| 7045 | System | New service installed. Common with remote execution utilities and ransomware deployment. |
| 1102 | Security | Audit log cleared. Strong evidence of deliberate track covering. |
| 4103 and 4104 | PowerShell | Module and script block logging. Records the actual script content executed. |
| 1149, 21, 24, 25 | Terminal Services | Remote desktop connection, session logon, disconnect, and reconnect. |
Two logon events can look identical until you read the type field. Getting this right is the difference between an accurate finding and an embarrassing one.
| Type | Name | Investigative meaning |
|---|---|---|
| 2 | Interactive | Someone at the physical keyboard, or a console session on a virtual machine. |
| 3 | Network | Access to a share or service across the network. Extremely common in lateral movement. |
| 4 | Batch | Scheduled task execution, which can indicate persistence. |
| 5 | Service | Service account start, useful for spotting a newly installed malicious service. |
| 7 | Unlock | A locked session was unlocked at the machine. |
| 8 | Network cleartext | Credentials sent in cleartext, often basic authentication against a web service. |
| 9 | New credentials | A process ran under alternate credentials, a common credential theft pattern. |
| 10 | Remote interactive | Remote desktop. The single most common hands on keyboard intrusion path in small and mid sized businesses. |
| 11 | Cached interactive | Logon validated from cached credentials because no domain controller was reachable. |
A defensible remote desktop finding pairs the security log with the Terminal Services channels. Event 1149 records the connection attempt and the source address before authentication completes. Event 21 records the session logon, 24 the disconnect, and 25 the reconnect. Together they survive situations where security log rollover has removed the corresponding 4624, and they frequently establish that the attacker returned to the same host repeatedly over days.
On an active file server, the records that prove how an intrusion started can disappear in hours. We can guide preservation today and image the systems that matter.
The most common reason a business cannot determine root cause is not attacker sophistication. It is log capacity.
Absent event logs, execution and access can often still be established from disk artifacts such as the master file table, the update sequence number journal, Prefetch, Amcache, ShimCache, shellbags, jump lists, and the system resource usage monitor database. These sources do not replace event logs, but they frequently answer the same questions from a different angle, and a good report explains which conclusions rest on which artifact.
Export the full event log files in their native format rather than filtered screenshots, and image affected disks where feasible so artifacts survive rebuild.
Confirm log configuration, maximum sizes, clearing events, and the earliest surviving record on every host so the coverage window is documented.
Line up authentication events with EDR telemetry, firewall connections, and cloud sign in logs on a normalized clock.
Tie each session to an account, source address, and workstation name, and separate legitimate administration from intrusion.
Produce findings that cite specific records by identifier and time stamp so any competent reviewer can reproduce the conclusion.
Windows keeps logs until the configured size limit is reached. On active servers that can be hours or days, not months.
Clearing is itself powerful evidence, and forwarded copies, backups, and disk artifacts frequently reconstruct the missing period.
A large failure volume followed by a single success is the signature of a successful password spray, not a failed one.
Native export with hashing preserves metadata, supports verification, and survives challenge. Screenshots do none of that.
| Capability | Default Windows auditing | Sysmon | Commercial EDR |
|---|---|---|---|
| Process command lines | Only with auditing policy enabled | Yes, by default configuration | Yes |
| File hashes on execution | No | Yes | Yes |
| Network connection per process | No | Yes | Yes |
| Survives host wipe | Only if forwarded | Only if forwarded | Yes, stored in vendor cloud |
| Cost | Included with Windows | Free | Licensed per endpoint |
| Retention | Until rollover | Until rollover or forwarding | Contracted tier |
We reconstruct Windows intrusions for businesses, counsel, and carriers, and we do it with methods that hold up when another expert reviews the work. Our examiners have testified to these artifacts in state and federal proceedings.
Defensible acquisition of affected servers and workstations with documented chain of custody before rebuild destroys artifacts.
A complete account of who accessed what, from where, and when, tied to specific event records.
Identification of log clearing, service tampering, time stamp manipulation, and evidence destruction attempts.
Execution and file access reconstruction from registry, journal, and execution artifacts on the disk image.
Findings written for non technical readers, defensible against cross examination and opposing expert review.
Practical configuration recommendations so the next incident is provable rather than speculative.
Consultations are confidential. We work directly with affected businesses, with outside counsel, and with cyber insurance carriers and brokers nationwide.
Elite Digital Forensics is an independent digital forensics firm serving businesses, attorneys, and insurers nationwide. Our examiners include former law enforcement forensic examiners who have testified as court qualified expert witnesses in state and federal proceedings. We do not sell security software and we do not manage client networks, so our findings carry no conflict of interest when the question is whether an environment was adequately secured.
Every engagement follows documented chain of custody, defensible acquisition methods, and reporting written for attorney review, insurer submission, regulator response, or courtroom use. Work performed at the direction of counsel is generally treated as attorney work product prepared in anticipation of litigation. Call (833) 292-3733 or request a confidential consultation.
Event 4624 with logon type 10 indicates remote interactive access. Corroborate it with Terminal Services events 1149 for the connection, 21 for session logon, 24 for disconnect, and 25 for reconnect, since those channels often survive when the security log has rolled over.
It means the Windows Security log was cleared. Legitimate administrators rarely clear security logs, so 1102 during an intrusion window is treated as an anti forensic act and is significant to both regulators and courts assessing conduct.
Retention is a function of configured maximum size and event volume rather than time. A domain controller with a default size can overwrite a full day within hours. Central forwarding is the only reliable way to extend the window.
Only if process command line auditing is enabled for event 4688, or if PowerShell script block logging (event 4104) or Sysmon is deployed. Without those settings, you get the executable name but not the arguments.
Wholesale clearing and service stoppage are common, but convincingly forging individual records is difficult and typically leaves inconsistencies in record numbers, channel sequence, and corroborating artifacts that an examiner can detect.
Check for forwarded copies, backup images, virtual machine snapshots, and the security platform archive. If the original disk still exists in any form, artifact analysis can frequently reconstruct much of what the logs would have shown.
This content is for educational and informational purposes only and does not constitute legal advice. Elite Digital Forensics provides independent digital forensic services and expert witness testimony; we do not provide legal representation. Every case is fact specific; outcomes depend on the evidence, jurisdiction, and counsel. Retain qualified legal counsel for advice about your matter.
Elite Digital Forensics Assistant
By submitting this form, you consent to be contacted by email, text, or phone. Your information is kept secure and confidential. Reply Stop to opt out at anytime.
IMPORTANT: Please remember to check your spam or junk folder