Skip to content
.evtx

Posts tagged "{tag}": #ntlm

← ← Back to blog
Reading Windows logons end to end: 4624, 4625, Kerberos and NTLM
How Windows logon auditing actually fits together — logon types, 4624/4625 fields and failure codes, the Kerberos 4768/4769/4771 chain, NTLM 4776, and how the events correlate across the domain controller and the target host.
evtxdfirlogonkerberos