Why Multiple event id 4624 generated?

• Question

• 

  

  0

  Sign in to vote

  I'm trying to find session duration of a user on a domain controller.When i logon instead of a single 4624 event two 4624 events are generated.Both has different logon id.One has some valid LOGON GUID while other has all zeroes in GUID.All session activities happens with the logon id of event which has zeroes in guid.When i logoff only one 4647 and two 4634 happens.Any explanation for such behaviour?

  ---

  SANYAM JAIN

  • Moved by Esther FanMicrosoft employee Monday, August 18, 2014 11:13 PM

  Thursday, July 31, 2014 1:41 PM