I would read a few things here and there, think I understood it, then move on to the next case repeating the same loop over and over again and never really acquiring full comprehension.

That is until one day I finally got tired of repeating the same questionsresearch and just made a cheat sheet laying out the most common RDP-related Event IDs that Id encountered along with their relevance and descriptions.

From that point on, as I sporadically encountered related questionsconfusion from others in the community, I would simply refer to my cheat sheet to provide an immediate response or clarification saving them from the hours of repeated questioning and research I had already done.

As such, I recently set out to try and find an easy route to the solution for this problem (i.e.

Though Ive found parts of the answer in posts here and there, each of them were missing parts of the puzzle (either missing IDs, descriptions, explanations, andor overall how they fit together in a chronological fashion).

I will say JPCERTCC did an awesome job capturing a ton of information here, I just cant quite decipher or discern the clear order of events and some appear out of order (at least how I have encountered them, but maybe Im reading it wrong).

At any rate, as they say, necessity is the mother of invention.

The Windows Event IDs in the XP days were different than those in Vista Operating Systems.

However, Ive yet to see (m)any of these commonly occurring in the wild.

Ultimately, in truly pragmatic fashion, I figured it would likely be most useful to sort them in the (chronological) order in which you might expect to find them.

Instead, authentication in this sense is referring to successful network authentication, as in someone successfully executed an RDP network connection to the target machine and it successfully responded and displayed a login window for the next step of entering credentials.

For example, if I launched the RDP Desktop Connection program on my computer, input a target IP, and hit enter, it would simply display the target systems screen and produce an 1149 Event ID indicating I had successfully connected to the target, WELL BEFORE I even entered any credentials.

So, repeat after me, An Event ID 1149 DOES NOT indicate successful authentication to a target, simply a successful RDP network connection.

Someone launched an RDP client, specified the target machine (possibly with a username and domain), and hit enter to make a successful network connection to the target.

However, in a bit more research, I discovered that often a Type 3 logon (for NLA) will occur prior to the Type 10 logon.

In addition, I also discovered that RDPing to a system of which youd previously RDPed and not formally logged offout would instead yield a Logon Type 7 logon versus the Logon Type 10 wed expect.

This makes sense in a way in that a Logon Type 7 (This workstation was unlocked) is essentially what is happening.

However, to delineate this from non-RDP Type 7 logons in which a person was sitting at the machine and just unlocked the machine, we can look for remote non-local IPs in the IpAddress field.

TL;DR: User successfully logged on to this system with the specified TargetUserName and TargetDomainName from the specified IpAddress.

The StatusSub Status Code will also be helpful in delineating legitimate failures (e.g.

TL;DR: User failed to log on to this system with the specified TargetUserName and TargetDomainName from the specified IpAddress.

When NLA is not enabled, you should see a 4625 Type 10 failure.

This ID is unique for each logon session and is also present in various other Event Log entries, making it theoretically useful for trackingdelineating a specific users activities, particularly on systems allowing multiple logged on users.

However, do take note that a unique LogonID is assigned for each session, meaning if a user connects, then disconnects (without logging out, thus simply ending the current session), then reconnects (i.e.

LogonID.

All to say that a single user(name) may have multiple unique LogonIDs to track depending how many sessions theyve instantiated, not to mention Windows makes it very confusing sometimes with multiple 4624s with different LogonIDs for the same session.

Rdp Security Package Error