When you logon to a Windows workstation, which security log tracks that event? It all depends on the type of account. Is the user logging on with an AD domain account, an Entra ID account or a local user account in that workstation’s SAM (Security Account Manager db)?
In on-prem environments, you can track domain account authentication activity from domain controller security logs, and you can monitor logon activity of domain and local accounts by collecting workstation and server logs. Yes, there is a difference between logon and authentication in Windows and it’s significant.
In the rare Entra-only (no on prem AD) environment, the authentication activity simply moves to the Entra sign-in logs.
In the far more common hybrid environment of on-prem AD and Entra you get useful events from all 3 sources:
- Entra ID sign-in logs
- Domain controller security logs
- Workstation and member server logs
Of course, Entra - for a variety of scenarios.
In this real training for free session, we will untangle the changing landscape of authentication and logon monitoring. I will show you the events logged on:
- Workstation’s security log
- Domain Controller’s security log
- Entra ID’s sign-in log
We will look at the actual events and discuss how to interpret them. As with any log there’s the usual share of duplicate and noise events.
Then, Abhilash Mamidela from our sponsor ManageEngine will show how their Log360 helps you get all of these events and make sense of them.
Please join us for this real training for free session.