Trying to find user actions in Windows EventLog – Properties…

Understanding User Activity Through Windows Event Logs: A Guide for Incident Investigation

In the realm of IT security and operational troubleshooting, one common challenge is determining whether specific user actions on Windows machines are performed manually or occur in the background. Such insights are invaluable when investigating incidents like unauthorized account additions, unusual login activities, or system misconfigurations.

Case Scenario: Investigating Unauthorized Email Account Addition

Consider a situation where a shared Windows desktop was found to have an email account added without clear attribution to any currently active user. The involved user account had already been deleted by the time the incident was discovered. Traditional traces, such as OST files or user-specific data, yielded no conclusive evidence. As a result, leveraging Windows Event Logs became a strategic approach to trace and interpret the activities leading to the account addition.

Key Windows Event IDs for Credential and Logon Activities

Upon reviewing event logs to identify potential indicators, two event IDs stood out as particularly relevant:

1. Event ID 5379 – Credential Reading Events
2. This event is triggered when credentials are accessed, particularly from the Credential Manager.
3. Event ID 4624 – Logon Events
4. Focused on the logon process, especially types 2 (interactive login) and 7 (network login), relevant when remote access is disabled or restricted.

Challenges in Log Data Interpretation

While these events offer avenues for insights, their interpretation can be complex. For instance, background processes such as automatic email polling or credential synchronization can generate these events without any direct user interaction, cluttering the logs.

An intriguing aspect observed relates to the Type property within Event ID 5379:

• The Type property can have values of 0 or 1.
• An initial hypothesis suggests that:
• Type = 0 might indicate automatic or background credential access.
• Type = 1 could signify user-initiated activity.

However, official documentation from Microsoft does not explicitly confirm this distinction. Some community sources and AI-generated insights (e.g., from ChatGPT) propose that Type functions as a status or response code rather than an interaction indicator.

Furthermore, other properties such as CountOfCredentialsReturned and ReturnCode may influence the interpretation:

• For example, even with Type=1, the CountOfCredentialsReturned might be 1, and ReturnCode may indicate success or error.
• This inconsistency underscores