Windows 日志安全审核

客官°小女子只卖身不卖艺 2022-08-07 12:37 155阅读 0赞

Windows Logon Type的含义

我只是把主要的内容整理了一下备查。

Logon type 2 Interactive  本地交互登录。最常见的登录方式。  
Logon type 3 Network 网络登录 - 最常见的是访问网络共享文件夹或打印机。IIS的认证也是Type 3  
Logon type 4 Batch 计划任务  
Logon Type 5 Service 服务  
某些服务是用一个域帐号来运行的，出现Failure常见的情况是管理员更改了域帐号密码，但是忘记重设Service中的帐号密码。  
Logon Type 7 Unlock 解除屏幕锁定  
很多公司都有这样的安全设置：当用户离开屏幕一段时间后，屏保程序会锁定计算机屏幕。解开屏幕锁定需要键入用户名和密码。此时产生的日志类型就是Type 7  
Logon Type 8 NetworkCleartext 网络明文登录 -- 通常发生在IIS 的 ASP登录。不推荐  
Logon Type 9 NewCredentials 新身份登录 -- 通常发生在RunAS方式运行某程序时的登录验证。  
Logon Type 10 RemoteInteractive 远程登录 -- 比如Terminal service或者RDP方式。但是Windows 2000是没有Type10的，用Type 2。WindowsXP/2003起有Type 10  
Logon Type 11 CachedInteractive 缓存登录  
为方便笔记本电脑用户，Windows会缓存前10次成功登录的登录。

<table style="color:rgb(51,51,51); padding:0px; margin:0px; font-size:12px; font-family:Verdana,Arial,Helvetica,sans-serif; line-height:21px"> 
 <tbody style="padding:0px; margin:0px"> 
  <tr style="padding:0px; margin:0px"> 
   <th style="padding:0px; margin:0px"> <p style="padding-top:8px; padding-bottom:8px; margin-top:0px; margin-bottom:0px; line-height:22px; text-align:justify; color:rgb(85,85,85)"> Windows&nbsp;<br style="padding:0px; margin:0px"> 事件 ID</p> </th> 
   <th style="padding:0px; margin:0px">Windows 2008 事件 ID</th> 
   <th style="padding:0px; margin:0px"> <p style="padding-top:8px; padding-bottom:8px; margin-top:0px; margin-bottom:0px; line-height:22px; text-align:justify; color:rgb(85,85,85)"> 事件类型</p> </th> 
   <th style="padding:0px; margin:0px"> <p style="padding-top:8px; padding-bottom:8px; margin-top:0px; margin-bottom:0px; line-height:22px; text-align:justify; color:rgb(85,85,85)"> 描述</p> </th> 
  </tr> 
  <tr style="padding:0px; margin:0px"> 
   <td align="center" style="padding:0px; margin:0px"> 
    <div style="padding:0px; margin:0px; border:0px; text-align:left">
      512, 513, 514, 515, 516, 518, 519, 520 
    </div> </td> 
   <td align="center" style="padding:0px; margin:0px"> 
    <div style="padding:0px; margin:0px; border:0px; text-align:left">
      4608, 4609, 4610, 4611, 4612, 4614, 4615, 4616 
    </div> </td> 
   <td align="center" style="padding:0px; margin:0px"> 
    <div style="padding:0px; margin:0px; border:0px; text-align:left">
      系统事件 
    </div> </td> 
   <td align="center" style="padding:0px; margin:0px"> 
    <div style="padding:0px; margin:0px; border:0px; text-align:left">
      本地系统进程，例如系统启动，关闭和系统时间的改变。 
    </div> </td> 
  </tr> 
  <tr style="padding:0px; margin:0px"> 
   <td align="center" style="padding:0px; margin:0px"> 
    <div style="padding:0px; margin:0px; border:0px; text-align:left">
      517 
    </div> </td> 
   <td align="center" style="padding:0px; margin:0px"> 
    <div style="padding:0px; margin:0px; border:0px; text-align:left">
      4612 
    </div> </td> 
   <td align="center" style="padding:0px; margin:0px"> 
    <div style="padding:0px; margin:0px; border:0px; text-align:left">
      清除的审计日志 
    </div> </td> 
   <td align="center" style="padding:0px; margin:0px"> 
    <div style="padding:0px; margin:0px; border:0px; text-align:left">
      所有审计日志清除事件 
    </div> </td> 
  </tr> 
  <tr style="padding:0px; margin:0px"> 
   <td align="center" style="padding:0px; margin:0px"> 
    <div style="padding:0px; margin:0px; border:0px; text-align:left">
      528, 540 
    </div> </td> 
   <td align="center" style="padding:0px; margin:0px"> 
    <div style="padding:0px; margin:0px; border:0px; text-align:left">
      4624 
    </div> </td> 
   <td align="center" style="padding:0px; margin:0px"> 
    <div style="padding:0px; margin:0px; border:0px; text-align:left">
      成功用户登录 
    </div> </td> 
   <td align="center" style="padding:0px; margin:0px"> 
    <div style="padding:0px; margin:0px; border:0px; text-align:left">
      所有用户登录事件 
    </div> </td> 
  </tr> 
  <tr style="padding:0px; margin:0px"> 
   <td align="center" style="padding:0px; margin:0px"> 
    <div style="padding:0px; margin:0px; border:0px; text-align:left">
      529, 530, 531, 532, 533, 534, 535, 536, 537 539 
    </div> </td> 
   <td align="center" style="padding:0px; margin:0px"> 
    <div style="padding:0px; margin:0px; border:0px; text-align:left">
      4625 
    </div> </td> 
   <td align="center" style="padding:0px; margin:0px"> 
    <div style="padding:0px; margin:0px; border:0px; text-align:left">
      登录失败 
    </div> </td> 
   <td align="center" style="padding:0px; margin:0px"> 
    <div style="padding:0px; margin:0px; border:0px; text-align:left">
      所有用户登录失败事件 
    </div> </td> 
  </tr> 
  <tr style="padding:0px; margin:0px"> 
   <td align="center" style="padding:0px; margin:0px"> 
    <div style="padding:0px; margin:0px; border:0px; text-align:left">
      538 
    </div> </td> 
   <td align="center" style="padding:0px; margin:0px"> 
    <div style="padding:0px; margin:0px; border:0px; text-align:left">
      4634 
    </div> </td> 
   <td align="center" style="padding:0px; margin:0px"> 
    <div style="padding:0px; margin:0px; border:0px; text-align:left">
      成功用户退出 
    </div> </td> 
   <td align="center" style="padding:0px; margin:0px"> 
    <div style="padding:0px; margin:0px; border:0px; text-align:left">
      所有用户退出事件 
    </div> </td> 
  </tr> 
  <tr style="padding:0px; margin:0px"> 
   <td align="center" style="padding:0px; margin:0px"> 
    <div style="padding:0px; margin:0px; border:0px; text-align:left">
      560, 562, 563, 564, 565, 566, 567, 568 
    </div> </td> 
   <td align="center" style="padding:0px; margin:0px"> 
    <div style="padding:0px; margin:0px; border:0px; text-align:left">
      4656, 4658, 4659, 4660, 4661, 4662, 4663, 4664 
    </div> </td> 
   <td align="center" style="padding:0px; margin:0px"> 
    <div style="padding:0px; margin:0px; border:0px; text-align:left">
      对象访问 
    </div> </td> 
   <td align="center" style="padding:0px; margin:0px"> 
    <div style="padding:0px; margin:0px; border:0px; text-align:left">
      当访问一给定的对象（文件，目录等） 访问的类型(例如读，写，删除) ，访问是否成功或失败，谁实施了这一行为 
    </div> </td> 
  </tr> 
  <tr style="padding:0px; margin:0px"> 
   <td align="center" style="padding:0px; margin:0px"> 
    <div style="padding:0px; margin:0px; border:0px; text-align:left">
      612 
    </div> </td> 
   <td align="center" style="padding:0px; margin:0px"> 
    <div style="padding:0px; margin:0px; border:0px; text-align:left">
      4719 
    </div> </td> 
   <td align="center" style="padding:0px; margin:0px"> 
    <div style="padding:0px; margin:0px; border:0px; text-align:left">
      审计政策改变 
    </div> </td> 
   <td align="center" style="padding:0px; margin:0px"> 
    <div style="padding:0px; margin:0px; border:0px; text-align:left">
      审计政策的改变 
    </div> </td> 
  </tr> 
  <tr style="padding:0px; margin:0px"> 
   <td align="center" style="padding:0px; margin:0px"> 
    <div style="padding:0px; margin:0px; border:0px; text-align:left">
      624, 625, 626, 627, 628, 629, 630, 642, 644 
    </div> </td> 
   <td align="center" style="padding:0px; margin:0px"> 
    <div style="padding:0px; margin:0px; border:0px; text-align:left">
      4720, 4722, 4723, 4724, 4725, 4726, 4738, 4740 
    </div> </td> 
   <td align="center" style="padding:0px; margin:0px"> 
    <div style="padding:0px; margin:0px; border:0px; text-align:left">
      用户帐号改变 
    </div> </td> 
   <td align="center" style="padding:0px; margin:0px"> 
    <div style="padding:0px; margin:0px; border:0px; text-align:left">
      用户帐号的改变，像用户帐号创建，删除，改变密码等等 
    </div> </td> 
  </tr> 
  <tr style="padding:0px; margin:0px"> 
   <td align="center" style="padding:0px; margin:0px"> 
    <div style="padding:0px; margin:0px; border:0px; text-align:left">
      (631 to 641) and (643, 645 to 666) 
    </div> </td> 
   <td align="center" style="padding:0px; margin:0px"> 
    <div style="padding:0px; margin:0px; border:0px; text-align:left">
      4727 to 4737, 4739 to 4762 
    </div> </td> 
   <td align="center" style="padding:0px; margin:0px"> 
    <div style="padding:0px; margin:0px; border:0px; text-align:left">
      用户组改变 
    </div> </td> 
   <td align="center" style="padding:0px; margin:0px"> 
    <div style="padding:0px; margin:0px; border:0px; text-align:left">
      对一个用户组的所有改变，例如添加或移除一个全局组或本地组，从全局组或本地添加或移除成员等等 
    </div> </td> 
  </tr> 
  <tr style="padding:0px; margin:0px"> 
   <td align="center" style="padding:0px; margin:0px"> 
    <div style="padding:0px; margin:0px; border:0px; text-align:left">
      672, 680 
    </div> </td> 
   <td align="center" style="padding:0px; margin:0px"> 
    <div style="padding:0px; margin:0px; border:0px; text-align:left">
      4768, 4776 
    </div> </td> 
   <td align="center" style="padding:0px; margin:0px"> 
    <div style="padding:0px; margin:0px; border:0px; text-align:left">
      成功用户帐号验证 
    </div> </td> 
   <td align="center" style="padding:0px; margin:0px"> 
    <div style="padding:0px; margin:0px; border:0px; text-align:left">
      当一个域用户帐号在域控制器认证时，生成用户帐号成功登录事件。 
    </div> </td> 
  </tr> 
  <tr style="padding:0px; margin:0px"> 
   <td align="center" style="padding:0px; margin:0px"> 
    <div style="padding:0px; margin:0px; border:0px; text-align:left">
      675, 681 
    </div> </td> 
   <td align="center" style="padding:0px; margin:0px"> 
    <div style="padding:0px; margin:0px; border:0px; text-align:left">
      4771, 4777 
    </div> </td> 
   <td align="center" style="padding:0px; margin:0px"> 
    <div style="padding:0px; margin:0px; border:0px; text-align:left">
      失败用户帐号验证 
    </div> </td> 
   <td align="center" style="padding:0px; margin:0px"> 
    <div style="padding:0px; margin:0px; border:0px; text-align:left">
      失败用户帐号登录事件，当一个域用户帐号在域控制器认证时 ，生成不成功用户帐号登录事件。 
    </div> </td> 
  </tr> 
  <tr style="padding:0px; margin:0px"> 
   <td align="center" style="padding:0px; margin:0px"> 
    <div style="padding:0px; margin:0px; border:0px; text-align:left">
      682, 683 
    </div> </td> 
   <td align="center" style="padding:0px; margin:0px"> 
    <div style="padding:0px; margin:0px; border:0px; text-align:left">
      4778, 4779 
    </div> </td> 
   <td align="center" style="padding:0px; margin:0px"> 
    <div style="padding:0px; margin:0px; border:0px; text-align:left">
      主机会话状态 
    </div> </td> 
   <td align="center" style="padding:0px; margin:0px"> 
    <div style="padding:0px; margin:0px; border:0px; text-align:left">
      会话重新连接或断开 
    </div> 
    <div> 
     <br> 
    </div> </td> 
  </tr> 
 </tbody> 
</table>