Webinar 72 Slides

8/3/2019 Webinar 72 Slides

1/10

2009 Monterey Technology Group Inc.

What is the Difference Between

Account Logon and

Logon/Logoff Events?


Commissioned

by:

Ultimate

Windows

Security.com

Brought to you by

2009 MontereyTechnology Group Inc.

Speaker Isaac Thompson

Director of Engineering and Training


2/10


Ultimate

Windows

Security.com Preview of key points

Authentication vs. Logon

.

Understanding

Account Logon Events

Logon/Logoff Events

Which should ou use?

Ultimate

Windows

Security.com Logons

2 kinds of accounts

Local computer SAM

AD domain accounts

2004-2006 MontereyTechnology Group Inc.

4


3/10


Ultimate

Windows

Security.com Logons

2 kinds of logons

Interactive

Network (aka remote)

Credentials enteredonce

But separate logon foreach computer accessed

Drivemapping

Networklogon


5

credentials for each

computer accessed

Ultimate

Windows

Security.com Specifying local or domain logons

Domain

LocalSAM


6


4/10


Ultimate

Windows

Security.com Specifying local or domain logons


7

[computer or domain name\]username

Ultimate

Windows

Security.com Logon vs. Authentication

Separate and distinct

computer where the account gains access toobjects and can run programs

Authentication

Computer that checks the accounts credentials


8


5/10


Ultimate

Windows

Security.com Logon vs. Authentication

Same computer for both

logging on with local SAM account

User is logging on to domain controller itself

Different computers

User logging onto workstation or member


9

server w t oma n account

Ultimate

Windows

Security.com 2 Audit policy/security log categories


10

Authentication events


6/10


Ultimate

Windows

Security.com 2 Audit policy/security log categories

Authentication vs. LogonsLogon/logoff events Logged whenever an account logs onto the

computer Interactively, network, batch, service, terminals

services

Account logon events Lo ed onl when local com uter


11

authenticates

Domain controllers - all domain account logons Member servers and workstations only localSAM accounts

Ultimate

Windows

Security.com Tracking authentication activity

Domain accounts

Each domain controller Enable Audit account

lo on events audit

Local accounts

Each workstation andserver

policy

Monitor security log forAccount Logon

category


12


7/10


Ultimate

Windows

Security.com User logs on with a domain account

Logon/logoff

events logged

Logon/logoff

events logged

Account Logon

events logged


13

Ultimate

Windows

Security.com User logs on with local SAM accounts

Logon/logoff

& Account Logon

events logged

Logon/logoff


14

& Account Logon

events logged


8/10


Ultimate

Windows

Security.com Interesting point

Logon/Logoff category on domaincontroller does not lo failed lo onsoccurring on workstations or memberservers even though user is a domainaccount


Ultimate

Windows

Security.com Bottom Line

Which should you use? Domain Controllers

Enable Account Logon for success and failure toprovide complete audit trail of allDomain account authentication activity

Computers accessed by each domain account

What about Logon/Logoff on domain controllers? Provides better audit trail of remote desktop and console

Generates lots of worthless network logon/logoff eventsevery time each computer applies group policy

Consider enabling only for failed events to identityattempts to break into DC itself


9/10


Ultimate

Windows

Security.com Bottom Line

Which should you use?

Enable Logon/Logoff for complete audit trail ofevery attempt to access that computer whether bya local or domain

What about Logon/Logoff on domain controllers?

Provides better audit trail of remote desktop and console

Generates lots of worthless network logon/logoff events

every time each computer applies group policy

Ultimate

Windows

Security.com

Brought to you by


Speaker Isaac Thompson

Director of Engineering and Training


10/10


Ultimate

Windows

Security.com Want to Learn More?

EventTracker [email protected]

Windows SecurityLog

www.prismmicrosys.com/ Attend Security Log Secrets

training Los Angeles

January 2010

www.ultimatewindowssecurity.

com/redir.aspx?name=sls2010

Get the Windows Security Log

Resource Kit

..com/grok


Documents

Webinar 72 Slides