Why Multiple event id 4624 generated? RRS feed

  • Question

  • I'm trying to find session duration of a user on a domain controller.When i logon instead of a single 4624 event two 4624 events are generated.Both has different logon id.One has some valid LOGON GUID while other has all zeroes in GUID.All session activities happens with the logon id of event which has zeroes in guid.When i logoff only one 4647 and two 4634 happens.Any explanation for such behaviour?


    Thursday, July 31, 2014 1:41 PM

All replies

  • This forum is for help in designing software, and you are not writing one. Try the windows server forums on technet for IT Pro question.

    Visual C++ MVP

    Sunday, August 17, 2014 3:28 PM